Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M
CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Medium 6.9
In plain English
A medium-severity uncontrolled resource consumption in activesupport from rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 | DEBIAN-CVE-2026-33169 |
| Debian:13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 | DEBIAN-CVE-2026-33169 |
| Debian:14 | rails | 2:7.2.3.1+dfsg-1 | DEBIAN-CVE-2026-33169 |
| RubyGems | activesupport | 8.1.2.1 | GHSA-cg4j-q9v8-6v38 |
| RubyGems | activesupport | 8.0.4.1 | GHSA-cg4j-q9v8-6v38 |
| RubyGems | activesupport | 7.2.3.1 | GHSA-cg4j-q9v8-6v38 |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2026-33169 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2026-33169 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2026-33169 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2026-33169 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rails | activesupport | >= 8.1.0.beta1, < 8.1.2.1>= 8.0.0.beta1, < 8.0.4.1< 7.2.3.1 |
Weakness: CWE-400, CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 x_refsource_CONFIRM
- https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 x_refsource_MISC
- https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 x_refsource_MISC
- https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 x_refsource_MISC
- https://github.com/rails/rails/releases/tag/v7.2.3.1 x_refsource_MISC
- https://github.com/rails/rails/releases/tag/v8.0.4.1 x_refsource_MISC
- https://github.com/rails/rails/releases/tag/v8.1.2.1 x_refsource_MISC