GitHub Advisoryadvisory · RubyGems

GHSA-p9fm-f462-ggrg Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

LOW Published 2026-03-25 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-33658
Ecosystem
RubyGems
Packages
activestorage
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-03-25

Affected packages

• RubyGems activestorage: >= 8.1.0, < 8.1.2.1 → fixed in 8.1.2.1 • RubyGems activestorage: >= 8.0.0, < 8.0.4.1 → fixed in 8.0.4.1 • RubyGems activestorage: < 7.2.3.1 → fixed in 7.2.3.1

Description

Impact Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone researcher thwin_htet.

Related

Alias · CVE (1)

  • CVE-2026-33658 Active Storage allows users to attach cloud and local files in Rails applications. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References