High severity · published Mar 23, 2026
CVE-2026-33174
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
activestorage · rails
>= 8.1.0.beta1, < 8.1.2.1; >= 8.0.0.beta1, < 8.0.4.1; < 7.2.3.1 · source: vendor
RA
Rails · Rubyonrails
before 7.2.3.1; 8.0.0 before 8.0.4.1; 8.1.0 before 8.1.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33174
Patch
https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
Patch
https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a
Patch
https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
Release Notes
https://github.com/rails/rails/releases/tag/v7.2.3.1
Release Notes
https://github.com/rails/rails/releases/tag/v8.0.4.1
Release Notes
https://github.com/rails/rails/releases/tag/v8.1.2.1
More from activestorage
9.8
CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
9.1
CVE-2026-33202
Rails Active Storage has possible glob injection in its DiskService
8.1
CVE-2025-24293
# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters…
6.5
CVE-2026-33658
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
5.3
CVE-2026-33173
Rails Active Storage has possible content type bypass via metadata in direct uploads