Log in Start free

Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Low 2.3

In plain English

A low-severity resource allocation without limits in activestorage from rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rails2:7.2.2.2+dfsg-2~deb13u2DEBIAN-CVE-2026-33658
Debian:14rails2:7.2.3.1+dfsg-1DEBIAN-CVE-2026-33658
RubyGemsactivestorage7.2.3.1GHSA-p9fm-f462-ggrg
RubyGemsactivestorage8.1.2.1GHSA-p9fm-f462-ggrg
RubyGemsactivestorage8.0.4.1GHSA-p9fm-f462-ggrg
Ubuntu:24.04:LTSrailsno fix listedUBUNTU-CVE-2026-33658
Ubuntu:25.10railsno fix listedUBUNTU-CVE-2026-33658
Ubuntu:26.04:LTSrailsno fix listedUBUNTU-CVE-2026-33658
Ubuntu:26.10railsno fix listedUBUNTU-CVE-2026-33658

Affected products (as reported)

VendorProductVersions
rails activestorage >= 8.1.0, < 8.1.2.1>= 8.0.0, < 8.0.4.1< 7.2.3.1

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References