CVE-2026-33174: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-24 · updated 2026-06-17
Weakness: CWE-789

Description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected products

Ruby on Rails: before 7.2.3.1; from 8.0.0 before 8.0.4.1; from 8.1.0 before 8.1.2.1 — fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1
Rubygems Activestorage: from 8.1.0.beta1 before 8.1.2.1; from 8.0.0.beta1 before 8.0.4.1; before 7.2.3.1; 8.1.0, 8.1.0.beta1, 8.1.0.rc1, 8.1.1, 8.1.2, 8.0.0 (+170) — fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1

How to fix

Upgrade to a fixed version: Ruby on Rails 7.2.3.1, 8.0.4.1, 8.1.2.1; Rubygems Activestorage 8.1.2.1, 8.0.4.1, 7.2.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33174 or the next vulnerability affects your stack