CVE-2026-33176 Details
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A denial-of-service vulnerability has been identified in the Active Support component of Ruby on Rails. This issue affects versions 7.2.3, 8.0.4, and 8.1, prior to 8.1.2.1. The vulnerability arises because Active Support number helpers improperly handle strings in scientific notation, such as '1e10000'. When these strings are processed, 'BigDecimal' converts them into extremely large decimal numbers. This conversion can lead to excessive memory usage and CPU load during number formatting, causing a denial-of-service condition.
Users can upgrade to Active Support versions 8.1.2.1, 8.0.4.1, or 7.2.3.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rubyonrails rails | < 7.2.3.1 >= 8.0.0, < 8.0.4.1 >= 8.1.0, < 8.1.2.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |