Active Storage DoS Vulnerability in Rails Products from Ruby on Rails
CVE-2026-126071

5.3MEDIUM

Key Information:

Vendor

Rails

Status
Rails
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126071?

A vulnerability in Active Storage allows an attacker to cause a denial of service (DoS) by exploiting error handling during file downloads. When Active Storage serves files and encounters a storage service error, it may improperly handle the HTTP response, leading to blocking of server threads. This occurs specifically when errors arise after initial data has been sent, causing the request to hang. Affected applications using cloud services for storage, like Amazon S3 and Google Cloud Storage, are at risk of thread exhaustion due to repeated failed downloads. This situation can be triggered by deletion of files during active serving or similar storage issues. It is recommended to upgrade to the patched versions 8.1.4.1 or 8.0.5.2 to mitigate this vulnerability.

Affected Version(s)

rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1

rails >= 8.0, < 8.0.5.2 < 8.0, 8.0.5.2

References

https://github.com/rails/rails/security/advisories/GHSA-4...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/3c67a693fb21870ecb1...
x_refsource_MISC
https://github.com/rails/rails/commit/655b4442de136a37013...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.