← Back

CVE-2026-33658

nvd nist
Published: Mar 26, 2026Modified: Jun 17, 2026

JSON object

Loading...
2.3
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security-advisories@github.com (Secondary)

Description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected (3)

Products: Rubyonrails: Rails
Rubyonrails
1 product
Rails
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Rubyonrails
Rails
Before 7.2.3.1
Rails
From 8.0.0 to 8.0.4.1
Rails
From 8.1.0 to 8.1.2.1

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (5)

Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
Third Party Advisory

Timeline

No history available yet.