CVE-2026-33176: Rails Active Support has a possible DoS vulnerability in its number helpers
(updated )
Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.
References
- github.com/advisories/GHSA-2j26-frm8-cmj9
- github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
- github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
- github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
- github.com/rails/rails/releases/tag/v7.2.3.1
- github.com/rails/rails/releases/tag/v8.0.4.1
- github.com/rails/rails/releases/tag/v8.1.2.1
- github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
- github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33176.yml
- nvd.nist.gov/vuln/detail/CVE-2026-33176
Code Behaviors & Features
Detect and mitigate CVE-2026-33176 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →