PT-2026-27261 · Unknown+1 · Active Support+1

Jhawthorn · Publicado 2026-03-23 · Atualizado 2026-05-06 · CVE-2026-33176

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description Active Support number helpers are susceptible to a denial-of-service condition. The number helpers accept strings containing scientific notation, such as 1e10000, which are expanded into extremely large decimal representations by BigDecimal. This expansion can lead to excessive memory allocation and CPU usage during formatting, potentially causing a DoS.

Recommendations Update to Active Support version 8.1.2.1 or later. Update to Active Support version 8.0.4.1 or later. Update to Active Support version 7.2.3.1 or later.

Exploit

Correção

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-400

CWE-770

Identificadores relacionados

BDU:2026-07237

CVE-2026-33176

GHSA-2J26-FRM8-CMJ9

RHSA-2026:14835

RHSA-2026:14873

RHSA-2026:14874

Produtos afetados

Active Support

Red Os

Referências · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33176.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33176.yml · Exploit
• https://github.com/rails/rails · Nota
• https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 · Correção
• https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb · Correção
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Nota
• https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a · Correção
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Nota
• https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33176 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33176 · Aviso do Fabricante
• https://twitter.com/fernandokarl/status/2036464598337945733 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-33176 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-33176 · Nota de Segurança