GitHub Advisoryadvisory · RubyGems

GHSA-r46p-8f7g-vvvg Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

MEDIUM Published 2026-03-23 Modified 2026-05-13 Official page ↗
Aliases
CVE-2026-33174
Ecosystem
RubyGems
Packages
activestorage
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-789
Reviewed
2026-03-23

Affected packages

• RubyGems activestorage: >= 8.1.0.beta1, < 8.1.2.1 → fixed in 8.1.2.1 • RubyGems activestorage: >= 8.0.0.beta1, < 8.0.4.1 → fixed in 8.0.4.1 • RubyGems activestorage: < 7.2.3.1 → fixed in 7.2.3.1

Description

Impact When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone user pirikara

Related

Alias · CVE (1)

  • CVE-2026-33174 Active Storage allows users to attach cloud and local files in Rails applications. vulnerability

Weakness · CWE (1)

  • CWE-789 Memory Allocation with Excessive Size Value weakness

References