Login Request a demo
Medium severity · published Mar 26, 2026
CVE-2026-33658
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
activestorage · rails
>= 8.1.0, < 8.1.2.1; >= 8.0.0, < 8.0.4.1; < 7.2.3.1 · source: vendor
RA
Rails · Rubyonrails
before 7.2.3.1; 8.0.0 before 8.0.4.1; 8.1.0 before 8.1.2.1 · source: NVD
Affected product
AC
activestorage
rails
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33658
Product
https://github.com/rails/rails/releases/tag/v7.2.3.1
Product
https://github.com/rails/rails/releases/tag/v8.0.4.1
Product
https://github.com/rails/rails/releases/tag/v8.1.2.1
Vendor Advisory
https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
Third Party Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml
More from activestorage
9.8
CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
9.1
CVE-2026-33202
Rails Active Storage has possible glob injection in its DiskService
8.1
CVE-2025-24293
# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters…
7.5
CVE-2026-33174
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
5.3
CVE-2026-33173
Rails Active Storage has possible content type bypass via metadata in direct uploads