PT-2026-28168 · Rails+1 · Rails+1

Thwin_Htet · Published 2026-03-25 · Updated 2026-05-08 · CVE-2026-33658

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1

Description Active Storage, used for attaching cloud and local files in Rails applications, is susceptible to a denial-of-service condition. The proxy controller within Active Storage does not restrict the number of byte ranges specified in an HTTP Range header. An attacker can exploit this by sending a request containing a large number of small ranges, leading to excessive CPU usage and potentially causing a denial of service.

Recommendations Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-07239

CVE-2026-33658

GHSA-P9FM-F462-GGRG

Affected Products

Rails

Red Os

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33658.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml · Exploit
• https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9fm-f462-ggrg · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07239 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33658 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33658 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33658 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33658 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33658 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33658 · Vendor Advisory
• https://github.com/rails/rails · Note
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Note
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Note