PT-2026-27256 · Rails · Active Support+1

Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-33169

NVD

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2026-33169

Affected Products

Active Support

Rails

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-33169 · Security Note
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Note
• https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 · Note
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Note
• https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 · Note
• https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 · Note
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Note
• https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38 · Note