CVE-2026-33658CWE-770

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Low · published March 26, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1

Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00434 · 36.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-26T21:03Z
EPSS history
Timeline
  • 26 MAR 21:03Z
    Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
    cvelistv5