PT-2026-27256 · Unknown+1 · Active Support+1

Jhawthorn · Published 2026-03-23 · Updated 2026-05-08 · CVE-2026-33169

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description The NumberToDelimitedConverter component utilizes a regular expression with gsub! to insert thousands delimiters. The interaction between a repeated lookahead group and gsub! can result in quadratic time complexity when processing long digit strings. This can potentially stall Ruby on Rails applications.

Recommendations Upgrade to Active Support version 8.1.2.1. Upgrade to Active Support version 8.0.4.1. Upgrade to Active Support version 7.2.3.1.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

BDU:2026-07236

CVE-2026-33169

GHSA-CG4J-Q9V8-6V38

Affected Products

Active Support

Red Os

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33169.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33169.yml · Exploit
• https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 · Vendor Advisory
• https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 · Patch
• https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 · Patch
• https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33169 · Security Note
• https://ubuntu.com/security/CVE-2026-33169 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg4j-q9v8-6v38 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33169 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33169 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33169 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33169 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33169 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07236 · Security Note