CVE-2026-33658
LOWRails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Title source: cnaDescription
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
References (5)
Scores
CVSS v4
2.3
EPSS
0.0002
EPSS Percentile
5.2%
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-770
Status
published
Products (4)
rails/activestorage
< 7.2.3.1
rails/activestorage
>= 8.0.0, < 8.0.4.1
rails/activestorage
>= 8.1.0, < 8.1.2.1
rubygems/activestorage
8.1.0 - 8.1.2.1RubyGems
Published
Mar 26, 2026
Tracked Since
Mar 27, 2026