CVE-2026-33658
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Record
CVE-2026-33658- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-16426
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Record
EUVD-2026-16426- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p9fm-f462-ggrg
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Impact
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.
Releases
The fixed releases are available at the normal locations.
Credit
This issue was responsibly reported by Hackerone researcher thwin_htet.
- Record
GHSA-p9fm-f462-ggrg- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Record
CVE-2026-33658- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Record
CVE-2026-33658- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-33658
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Record
DEBIAN-CVE-2026-33658- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-p9fm-f462-ggrg
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Impact
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.
Releases
The fixed releases are available at the normal locations.
Credit
This issue was responsibly reported by Hackerone researcher thwin_htet.
- Record
GHSA-p9fm-f462-ggrg- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-33658
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Record
UBUNTU-CVE-2026-33658- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activestorageRubyGems |
8.1.0 up to 8.1.2.1 | 8.1.2.1 |
activestorageRubyGems |
8.0.0 up to 8.0.4.1 | 8.0.4.1 |
activestorageRubyGems |
before 7.2.3.1 | 7.2.3.1 |
railsDebian:13 |
before 2:7.2.2.2+dfsg-2~deb13u2, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-2~deb13u1 |
2:7.2.2.2+dfsg-2~deb13u2 |
railsDebian:14 |
before 2:7.2.3.1+dfsg-1, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-22:7.2.2.2+dfsg-2~deb13u12:7.2.2.2+dfsg-2~deb13u22:7.2.3+dfsg-12:7.2.3+dfsg-22:7.2.3+dfsg-3 |
2:7.2.3.1+dfsg-1 |
activestorageRubyGems |
8.1.0 up to 8.1.2.1, plus listed versions 8.1.18.1.2 |
8.1.2.1 |
activestorageRubyGems |
8.0.0 up to 8.0.4.1, plus listed versions 8.0.0.18.0.18.0.28.0.2.18.0.38.0.4 |
8.0.4.1 |
activestorageRubyGems |
before 7.2.3.1, plus listed versions 0.15.2.05.2.0.beta15.2.0.beta25.2.0.rc1 Show 45 moreShow less5.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.5 |
7.2.3.1 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33658 is a low vulnerability (CVSS 2.3) in Rubyonrails Rails, published March 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in activestorage 8.1.2.1.
References
github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
nvd.nist.gov/vuln/detail/CVE-2026-33658
Left out here: 111 versions. The JSON record has them.