CVE-2026-33658

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Allocation of Resources Without Limits or Throttling pada rubyonrails rails. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg advisory vendor
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml advisory pihak ketiga
• https://github.com/rails/rails/releases/tag/v7.2.3.1 product · release notes
• https://github.com/rails/rails/releases/tag/v8.0.4.1 product · release notes
• https://github.com/rails/rails/releases/tag/v8.1.2.1 product · release notes