Ruby on Rails Active Support Vulnerability in NumberToDelimitedConverter
CVE-2026-33169

6.9MEDIUM

Key Information:

Vendor

Rails

Status
Activesupport
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33169?

The Active Support library in Ruby on Rails contains a vulnerability in the NumberToDelimitedConverter that may lead to performance issues caused by quadratic time complexity when processing long digit strings. This occurs due to a problematic interaction between a repeated lookahead group in a regular expression used with the 'gsub!' method. Patches have been introduced in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 to address this issue.

Affected Version(s)

activesupport >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1

activesupport >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1

activesupport < 7.2.3.1 < 7.2.3.1

References

https://github.com/rails/rails/security/advisories/GHSA-c...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/29154f1097da13d48fd...
x_refsource_MISC
https://github.com/rails/rails/commit/b54a4b373c6f042cab6...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.