VulnSocial

CVE-2026-33658Disclosure(rubyonrails / rails)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch rubyonrails rails systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

rubyonrails CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rails

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-26)
  • 3 total mentions across 2 days

Affected systems

Vendors
rubyonrails
Products
rails

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-23: 1Mentions · 2026-03-26: 2Patch / Workaround · 2026-03-23: 1Technical Details · 2026-03-23: 1Technical Details · 2026-03-26: 103-2303-26
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-03-231
Patch1
2026-03-262
Disclosure2
Full discourse3 posts
  • RUBYLAND@rubylandnews
    Disclosure

    RubySec ➜ CVE-2026-33658 (activestorage): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests https://rubysec.com/advisories/CVE-2026-33658/

    Post summary

    RubySec announces CVE-2026-33658 as a potential DoS vulnerability in Rails Active Storage’s proxy mode due to multi‑range requests; no PoC, exploit code, or active exploitation is reported.

    0002090
    2.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33658 Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller d… https://www.cve.org/CVERecord?id=CVE-2026-33658

    Post summary

    The passage indicates that CVE‑2026‑33658 has been disclosed and affects certain Rails Active Storage versions, but it lacks details on exploitation, remediation, or technical specifics.

    0000050
    56.9K followersView on X
  • ダース葱@darthnegi
    Patch

    🚀 Ruby on Rails v7.2.3.1 がリリースされました。 📦 種別: patch ✨ 主な変更点: • Active Support: NumberConverterにおける指数表記を拒否するよう修正（CVE-2026-33176） • Active Support: `SafeBuffer#%` がunsafeステータスを保持するように修正（CVE-2026-33170） • Active Support: NumberToDelimitedConverterのパフォーマンスを改善（CVE-2026-33169） • Action View: タグヘルパーで空の属性名をスキップし、不正なHTML生成を回避（CVE-2026-33168） • Active Storage: DirectUploadControllerでユーザー提供のメタデータをフィルタリング（CVE-2026-33173） • Active Storage: 最大ストリーミングチャンクサイズを設定可能に（CVE-2026-33174） • Active Storage: 範囲リクエストを単一の範囲に制限（CVE-2026-33658） • Active Storage: `DiskService`におけるパストラバーサルを防止（CVE-2026-33195） • Active Storage: `DiskService#delete_prefixed`におけるグロブインジェクションを防止（CVE-2026-33202） ⚠️ 破壊的変更: • `DiskService#delete_prefixed`の変更により、既存のグロブメタ文字展開に依存するコードは動作しなくなります。 🔧 重要な修正: • Active Support: NumberConverterにおける指数表記を拒否するよう修正（CVE-2026-33176） • Active Support: `SafeBuffer#%` がunsafeステータスを保持するように修正（CVE-2026-33170） • Active Support: NumberToDelimitedConverterのパフォーマンスを改善（CVE-2026-33169） • Action View: タグヘルパーで空の属性名をスキップし、不正なHTML生成を回避（CVE-2026-33168） • Active Storage: DirectUploadControllerでユーザー提供のメタデータをフィルタリング（CVE-2026-33173） • Active Storage: 最大ストリーミングチャンクサイズを設定可能に（CVE-2026-33174） • Active Storage: 範囲リクエストを単一の範囲に制限（CVE-2026-33658） • Active Storage: `DiskService`におけるパストラバーサルを防止（CVE-2026-33195） • Active Storage: `DiskService#delete_prefixed`におけるグロブインジェクションを防止（CVE-2026-33202） #GitHub #Release #Ruby on Rails

    Post summary

    Rails 7.2.3.1 is a patch release addressing several CVEs by fixing issues like unsafe string formatting, XSS prevention, path traversal, and glob injection.

    0000036
    2 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apprubyonrailsrails---

Explore more

Back to dashboardrubyonrails CVEsrails vulnerabilities