PT-2026-27261 · Unknown+1 · Active Support+1

Jhawthorn · Published 2026-03-23 · Updated 2026-05-06 · CVE-2026-33176

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description Active Support number helpers are susceptible to a denial-of-service condition. The number helpers accept strings containing scientific notation, such as 1e10000, which are expanded into extremely large decimal representations by BigDecimal. This expansion can lead to excessive memory allocation and CPU usage during formatting, potentially causing a DoS.

Recommendations Update to Active Support version 8.1.2.1 or later. Update to Active Support version 8.0.4.1 or later. Update to Active Support version 7.2.3.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2026-07237

CVE-2026-33176

GHSA-2J26-FRM8-CMJ9

RHSA-2026:14835

RHSA-2026:14873

RHSA-2026:14874

Affected Products

Active Support

Red Os

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33176.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33176.yml · Exploit
• https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb · Patch
• https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 · Vendor Advisory
• https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a · Patch
• https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 · Patch
• https://cve.org/CVERecord?id=CVE-2026-33176 · Security Note
• https://ubuntu.com/security/CVE-2026-33176 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33176 · Security Note
• https://osv.dev/vulnerability/GHSA-2j26-frm8-cmj9 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33176 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33176 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33176 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07237 · Security Note