PT-2026-27256 · Unknown+1 · Active Support+1

Jhawthorn · Publicado 2026-03-23 · Atualizado 2026-05-08 · CVE-2026-33169

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description The NumberToDelimitedConverter component utilizes a regular expression with gsub! to insert thousands delimiters. The interaction between a repeated lookahead group and gsub! can result in quadratic time complexity when processing long digit strings. This can potentially stall Ruby on Rails applications.

Recommendations Upgrade to Active Support version 8.1.2.1. Upgrade to Active Support version 8.0.4.1. Upgrade to Active Support version 7.2.3.1.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-1333

CWE-400

Identificadores relacionados

BDU:2026-07236

CVE-2026-33169

GHSA-CG4J-Q9V8-6V38

Produtos afetados

Active Support

Red Os

Referências · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33169.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33169.yml · Exploit
• https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 · Aviso do Fabricante
• https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 · Correção
• https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 · Correção
• https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 · Correção
• https://github.com/rails/rails · Nota
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33169 · Nota de Segurança
• https://twitter.com/CVEarity/status/2036461096836665820 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-33169 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cg4j-q9v8-6v38 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33169 · Aviso do Fabricante