GitHub Advisoryadvisory · RubyGems
GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
MEDIUM
Official page ↗
- Aliases
- CVE-2026-33169
- Ecosystem
- RubyGems
- Packages
- activesupport
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Weaknesses
- CWE-1333, CWE-400
- Reviewed
- 2026-03-23
Affected packages
• RubyGems activesupport: >= 8.1.0.beta1, < 8.1.2.1 → fixed in 8.1.2.1
• RubyGems activesupport: >= 8.0.0.beta1, < 8.0.4.1 → fixed in 8.0.4.1
• RubyGems activesupport: < 7.2.3.1 → fixed in 7.2.3.1
Description
Impact
`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.
Releases
The fixed releases are available at the normal locations.
Credit
This issue was responsibly reported by Hackerone researcher scyoon.
Related
Alias · CVE (1)
- CVE-2026-33169 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. vulnerability
References
- https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-33169 advisory
- https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 web
- https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 web
- https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 web
- https://github.com/rails/rails package
- https://github.com/rails/rails/releases/tag/v7.2.3.1 web
- https://github.com/rails/rails/releases/tag/v8.0.4.1 web
- https://github.com/rails/rails/releases/tag/v8.1.2.1 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33169.yml web