Denial-of-Service Vulnerability in Active Storage by Rails
CVE-2026-33658

2.3LOW

Key Information:

Vendor

Rails

Status
Activestorage
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33658?

Active Storage, a feature within Rails applications for attaching cloud and local files, has a vulnerability in its proxy controller. This vulnerability arises due to the absence of restrictions on the number of byte ranges in an HTTP Range header. An attacker can exploit this by sending requests with numerous small ranges, which can lead to excessive CPU utilization, far exceeding that of a standard request for the same file. This behavior could potentially facilitate a Denial-of-Service (DoS) condition, impacting the availability of the affected application. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain fixes for this vulnerability.

Affected Version(s)

activestorage >= 8.1.0, < 8.1.2.1 < 8.1.0, 8.1.2.1

activestorage >= 8.0.0, < 8.0.4.1 < 8.0.0, 8.0.4.1

activestorage < 7.2.3.1 < 7.2.3.1

References

https://github.com/rails/rails/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/rails/rails/releases/tag/v7.2.3.1
x_refsource_MISC
https://github.com/rails/rails/releases/tag/v8.0.4.1
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.