PT-2026-27261 · Rails · Active Support

Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-33176

Mitre

CVSS v4.0

6.6

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which BigDecimal expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-33176

Affected Products

Active Support

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-33176 · Security Note
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Note
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Note
• https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 · Note
• https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb · Note
• https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a · Note
• https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 · Note
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Note