CVE-2026-33658: Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
(updated )
Active Storage’s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.
References
- github.com/advisories/GHSA-p9fm-f462-ggrg
- github.com/rails/rails/releases/tag/v7.2.3.1
- github.com/rails/rails/releases/tag/v8.0.4.1
- github.com/rails/rails/releases/tag/v8.1.2.1
- github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
- github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml
- nvd.nist.gov/vuln/detail/CVE-2026-33658
Code Behaviors & Features
Detect and mitigate CVE-2026-33658 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →