Vulnerability advisory
CVE-2026-33176
Rails Active Support has a possible DoS vulnerability in its number helpers
Also known as GHSA-2j26-frm8-cmj9
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| All commits before ba76fca032a66f3716ca8a661c9ddb006acaf885 | ba76fca032a66f3716ca8a661c9ddb006acaf885 |
| dd8f7185faeca6ee968a6e9367f6d8601a83b8db to before a79efed95797b196575a98845dc989e3106a9acb | a79efed95797b196575a98845dc989e3106a9acb |
| 1cdd190a25e483b65f1f25bbd0f13a25d696b461 to before 1db4b89687cc18311fc3f92623136705df24e671 | 1db4b89687cc18311fc3f92623136705df24e671 |
| Not specified | 19dbab51ca086a657bb86458042bc44314916bcb |
| Not specified | ebd6be18120d1136511eb516338e27af25ac0a1a |
| Not specified | ee2c59e730e5b8faed502cd2c573109df093f856 |
Also listed as affected (56)
| |
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which BigDecimal expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
References
- Webgithub.com/rails/rails/releases/tag/v7.2.3.1 ↗
- Webgithub.com/rails/rails/releases/tag/v8.0.4.1 ↗
- Webgithub.com/rails/rails/releases/tag/v8.1.2.1 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33176.json ↗
- Advisorygithub.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-33176 ↗
- Fixgithub.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb ↗
- Fixgithub.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a ↗
- Fixgithub.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 ↗