CVE-2026-33174 Details
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A denial-of-service vulnerability has been identified in Rails Active Storage versions 8.1.2.1, 8.0.4.1, and prior to 7.2.3.1. When files are served through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. This behavior can be exploited by sending a request with a large or unbounded Range header, such as 'bytes=0-', causing the server to allocate memory proportional to the file size. This memory exhaustion can lead to a denial-of-service condition.
Users can upgrade to Rails Active Storage versions 8.1.2.1, 8.0.4.1, or 7.2.3.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rubyonrails rails | < 7.2.3.1 >= 8.0.0, < 8.0.4.1 >= 8.1.0, < 8.1.2.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |