Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests (rails activestorage)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.45 % · percentile 39 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Weaknesses (CWE)
- CWE-770 — Allocation of Resources Without Limits or Throttling
References
- https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | LOW 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U | GitHub_M |
| CVSS 4.0 | LOW 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-p9fm-f462-ggrg — Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
European references
- ENISA EUVD · EUVD-2026-16426
- GCVE · GCVE-0-2026-33658
CERT-FR advisories
- CERTFR-2026-AVI-0349 — Multiples vulnérabilités dans Ruby on Rails · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*< 7.2.3.1cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.4.1cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.2.1
Affected products
| Product | Versions |
|---|---|
| rails · activestorage | affected >= 8.1.0, < 8.1.2.1 ; affected >= 8.0.0, < 8.0.4.1 ; affected < 7.2.3.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |