DoS Vulnerability in Active Support Toolkit Affecting Ruby on Rails
CVE-2026-33176
6.6MEDIUM
What is CVE-2026-33176?
Active Support, a component of the Ruby on Rails framework, is susceptible to a Denial of Service vulnerability due to its handling of numeric strings in scientific notation. When certain strings, such as 1e10000, are processed, they are expanded into excessively large decimal values by BigDecimal. This process can lead to significant memory allocation and increased CPU usage, which may ultimately cause the application to become unresponsive. To remedy this issue, users are advised to upgrade to patched versions 8.1.2.1, 8.0.4.1, or 7.2.3.1.
Affected Version(s)
activesupport >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
activesupport >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
activesupport < 7.2.3.1 < 7.2.3.1