CVE-2026-33174
published 2026-03-24CVE-2026-33174: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.61%
45.3th percentile
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rails | — | — |
| rails | activestorage | < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | — | — |
| rails | activestorage | — | — |
| rails | activestorage | >= 0 < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | >= 8.0.0.beta1 < 8.0.4.1 | 8.0.4.1 |
| rails | activestorage | >= 8.1.0.beta1 < 8.1.2.1 | 8.1.2.1 |
| rubyonrails | rails | < 7.2.3.1 | 7.2.3.1 |
| rubyonrails | rails | >= 8.0.0 < 8.0.4.1 | 8.0.4.1 |
| rubyonrails | rails | >= 8.1.0 < 8.1.2.1 | 8.1.2.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.6MEDIUM
vendor_debian6.6MEDIUM
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
vendor_redhat·2026-03-23·CVSS 6.6
CVE-2026-33174 [MEDIUM] CWE-770 Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A flaw was found in Rails Active Storage. A remote attacker can exploit this vulnerability by sending a request with a large or unbounded Range header, such
Debian
CVE-2026-33174: rails - Active Storage allows users to attach cloud and local files in Rails application...
vendor_debian·2026·CVSS 6.6
CVE-2026-33174 [MEDIUM] CVE-2026-33174: rails - Active Storage allows users to attach cloud and local files in Rails application...
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-33174: Active Storage allows users to attach cloud and local files in Rails applications
osv·2026-03-24·CVSS 6.6
CVE-2026-33174 [MEDIUM] CVE-2026-33174: Active Storage allows users to attach cloud and local files in Rails applications
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
GHSA
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
ghsa·2026-03-23
CVE-2026-33174 [MEDIUM] CWE-789 Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
### Impact
When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.
### Releases
The fixed releases are available at the normal locations.
OSV
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
osv·2026-03-23
CVE-2026-33174 [MEDIUM] Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
### Impact
When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.
### Releases
The fixed releases are available at the normal locations.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-33174 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-33174 [MEDIUM] CVE-2026-33174 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33174 :
Ruby vulnerability analysis and mitigation
bytes=0-
Source : NVD
## 6.6
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 6.6
Affected Technologies
Ruby
Rails
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
ruby3.2-rails-8.1
ruby3.4-rails-8.0
Sources
Chainguard Has Fix Added at: Mar 25, 2026
Debian 11, 14 Severity HIGH No Fix Added at: Mar 26, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 26, 2026
Echo Severity HIGH No Fix Added at: Mar 26, 2026
RubyGems Severity MEDIUM Has Fix Added at: Mar 24, 2026
Linux Severity HIGH Has Fix Added at: Mar 24, 2026
Wolfi Has Fix A
Bugzilla
CVE-2026-33174 rubygem-activestorage: Rails Active Storage: Denial of Service via unbounded Range header [fedora-all]
bugzilla·2026-04-09·CVSS 6.6
CVE-2026-33174 [MEDIUM] CVE-2026-33174 rubygem-activestorage: Rails Active Storage: Denial of Service via unbounded Range header [fedora-all]
CVE-2026-33174 rubygem-activestorage: Rails Active Storage: Denial of Service via unbounded Range header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-33174 Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
bugzilla·2026-03-24·CVSS 6.6
CVE-2026-33174 [MEDIUM] CVE-2026-33174 Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
CVE-2026-33174 Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92ahttps://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229bhttps://github.com/rails/rails/releases/tag/v7.2.3.1https://github.com/rails/rails/releases/tag/v8.0.4.1https://github.com/rails/rails/releases/tag/v8.1.2.1https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
2026-03-24
Published