VDB
CVE-2026-33174
CVE-2026-33174
PUBLISHED
CVSS 6.599999904632568 MEDIUM
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
EPSS 0.02% · 7.1th percentile
Risk Scores
CVSS v4.0
6.599999904632568
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
EPSS Score
0.02%
7.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| rails | activestorage | *, >= 8.0.0.beta1, < 8.0.4.1, < 7.2.3.1 |
| RubyGems | activestorage | 8.1.0.beta1, 0, * |
| rubyonrails | rails | 0, 8.0.0, 8.1.0 |
Timeline
- Mar 23, 2026 CVE Published
- Mar 24, 2026 EPSS Score
- Mar 24, 2026 PoC Published
- Mar 24, 2026 Security Advisory
- Mar 25, 2026 EPSS Score
- Mar 25, 2026 Coalition ESS Score
- May 13, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
References
- https://discuss.rubyonrails.org/t/cve-2026-33168-possible-xss-vulnerability-in-action-view-tag-helpers/90912 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33169-possible-redos-vulnerability-in-number-to-delimited-in-active-support/90911 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33170-possible-xss-vulnerability-in-safebuffer-in-active-support/90910 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33167-possible-xss-vulnerability-in-action-pack-debug-exceptions/90913 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33174-possible-dos-vulnerability-in-active-storage-proxy-mode-via-range-requests/90908 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33202-possible-glob-injection-in-active-storage-diskservice/90903 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33195-possible-path-traversal-in-active-storage-diskservice/90904 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33173-insufficient-filtering-of-metadata-in-active-storage-direct-uploads/90909 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33176-possible-dos-vulnerability-in-active-support-number-helpers/90907 advisory
- https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m url
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c url
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf url
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 url
- https://github.com/rails/rails/releases/tag/v7.2.3.1 url
- https://github.com/rails/rails/releases/tag/v8.0.4.1 url
- https://github.com/rails/rails/releases/tag/v8.1.2.1 url
- https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg url
- https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5 url
- https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a url
…and 3 more