CVE-2026-33174

CWE-789CWE-770 — Allocation without Limits10 documents8 sources
Severity
6.6MEDIUM
EPSS
0.0%
top 94.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rails ActivestorageRubyonrails Rails
Timeline
PublishedMar 24
Latest updateApr 9

Description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Vers…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶CVEListV5rails/activestorage< 7.2.3.1+2
▶RubyGemsactivestorage8.1.0.beta1 — 8.1.2.1+2
▶NVDrubyonrails/rails8.0.0 — 8.0.4.1+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
CVE-2026-33174: Active Storage allows users to attach cloud and local files in Rails applications↗2026-03-24
▶
CVEList
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests↗2026-03-23
▶
GHSA
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests↗2026-03-23
▶
OSV
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests↗2026-03-23
▶

📋Vendor Advisories

2
Red Hat
Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header↗2026-03-23
▶
Debian
CVE-2026-33174: rails - Active Storage allows users to attach cloud and local files in Rails application...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33174 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2026-33174 rubygem-activestorage: Rails Active Storage: Denial of Service via unbounded Range header [fedora-all]↗2026-04-09
▶
Bugzilla
CVE-2026-33174 Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header↗2026-03-24
▶