PT-2026-28168 · Rubygems · Active Storage

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-33658

OSV

CVSS v4.0

2.3

Low

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Impact

Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-33658

GHSA-P9FM-F462-GGRG

Affected Products

Active Storage

References · 3

• https://osv.dev/vulnerability/GHSA-p9fm-f462-ggrg · Vendor Advisory
• https://github.com/rails/rails · Note
• https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg · Note