Memory Exhaustion Vulnerability in Active Storage of Rails Applications
CVE-2026-33174
6.6MEDIUM
What is CVE-2026-33174?
Active Storage in Rails applications allows users to attach files from both cloud and local sources. Prior to the release of version 8.1.2.1, 8.0.4.1, and 7.2.3.1, a flaw existed when serving files through the proxy delivery mode. The proxy controller would load the entire requested byte range into memory, which left applications vulnerable to memory exhaustion through large or unbounded Range header requests (e.g., 'bytes=0-'). This could lead to significant performance issues or even system downtime. The newer versions address and mitigate this vulnerability effectively.
Affected Version(s)
activestorage >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
activestorage >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
activestorage < 7.2.3.1 < 7.2.3.1