Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M
CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpers
Medium 6.6
In plain English
A medium-severity uncontrolled resource consumption in activesupport from rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 | DEBIAN-CVE-2026-33176 |
| Debian:13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 | DEBIAN-CVE-2026-33176 |
| Debian:14 | rails | 2:7.2.3.1+dfsg-1 | DEBIAN-CVE-2026-33176 |
| RubyGems | activesupport | 8.1.2.1 | GHSA-2j26-frm8-cmj9 |
| RubyGems | activesupport | 8.0.4.1 | GHSA-2j26-frm8-cmj9 |
| RubyGems | activesupport | 7.2.3.1 | GHSA-2j26-frm8-cmj9 |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2026-33176 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2026-33176 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2026-33176 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2026-33176 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rails | activesupport | >= 8.1.0.beta1, < 8.1.2.1>= 8.0.0.beta1, < 8.0.4.1< 7.2.3.1 |
Weakness: CWE-400, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
References
- https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 x_refsource_CONFIRM
- https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb x_refsource_MISC
- https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a x_refsource_MISC
- https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 x_refsource_MISC
- https://github.com/rails/rails/releases/tag/v7.2.3.1 x_refsource_MISC
- https://github.com/rails/rails/releases/tag/v8.0.4.1 x_refsource_MISC
- https://github.com/rails/rails/releases/tag/v8.1.2.1 x_refsource_MISC