Vulnerability advisory
CVE-2026-33169
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Also known as GHSA-cg4j-q9v8-6v38
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| All commits before ba76fca032a66f3716ca8a661c9ddb006acaf885 | ba76fca032a66f3716ca8a661c9ddb006acaf885 |
| dd8f7185faeca6ee968a6e9367f6d8601a83b8db to before a79efed95797b196575a98845dc989e3106a9acb | a79efed95797b196575a98845dc989e3106a9acb |
| 1cdd190a25e483b65f1f25bbd0f13a25d696b461 to before 1db4b89687cc18311fc3f92623136705df24e671 | 1db4b89687cc18311fc3f92623136705df24e671 |
| Not specified | 29154f1097da13d48fdb3200760b3e3da66dcb11 |
| Not specified | b54a4b373c6f042cab6ee2033246b1c9ecc38974 |
| Not specified | ec1a0e215efd27a3b3911aae6df978a80f456a49 |
Also listed as affected (56)
| |
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
References
- Webgithub.com/rails/rails/releases/tag/v7.2.3.1 ↗
- Webgithub.com/rails/rails/releases/tag/v8.0.4.1 ↗
- Webgithub.com/rails/rails/releases/tag/v8.1.2.1 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33169.json ↗
- Advisorygithub.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-33169 ↗
- Fixgithub.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 ↗
- Fixgithub.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 ↗
- Fixgithub.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 ↗