Red Hat CVE-2026-33169
MEDIUMVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk assessment reveals a moderate-to-high priority vulnerability despite missing CVSS and EPSS scores. The attack vector is network-based (assuming the vulnerable converter is exposed via web services), the attack complexity is low (any attacker can send a long digit string), and no special privileges are required, indicating broad exploitability. The presence of multiple confirmed patches across three stable Rails versions (7.2.3.1, 8.0.4.1, 8.1.2.1) from the official Rails repository demonstrates vendor acknowledgment and active mitigation. The vulnerability is not listed as actively exploited in known exploit databases, but the simplicity of the attack (sending crafted numeric input) and the absence of authentication requirements makes exploitation trivial for any remote client. From an SSVC perspective, the technical impact is high (denial of service), the exploitability is functional (patches exist), and the automatable nature is high (any HTTP client can trigger it). Organizations running unpatched Rails applications that expose number formatting functionality should prioritize patching. |
| Exploit ScenarioDerived | An attacker sends an HTTP request to a Rails application that formats numbers for display (e.g., a financial dashboard or reporting API endpoint). The request includes a very long string of digits (e.g., thousands of consecutive numerals) in a parameter that triggers the NumberToDelimitedConverter. The vulnerable regex processing enters catastrophic backtracking, consuming 100% CPU and blocking the application thread or process. If the application uses a thread pool (common in production Rails deployments), repeated requests with different digit strings can exhaust all available threads, causing the application to become unresponsive to legitimate users and resulting in denial of service. No specialized tooling is required; any HTTP client can exploit this with a simple POST or GET request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A regular expression denial of service (ReDoS) vulnerability exists in Rails ActiveSupport's NumberToDelimitedConverter, which uses gsub! with an inefficient regex pattern to insert thousands delimiters into numeric strings. An attacker can craft excessively long digit strings that cause quadratic time complexity, leading to CPU exhaustion and denial of service. Patches are available from the Rails project for versions 7.2.3.1, 8.0.4.1, and 8.1.2.1, and the vulnerability is tagged as a denial of service issue affecting the activesupport gem.
RemediationAI
Immediately upgrade Ruby on Rails to version 7.2.3.1, 8.0.4.1, 8.1.2.1, or later, depending on your current release branch. The patches are available from the official Rails releases at https://github.com/rails/rails/releases and have been committed to the main repository (see commits 29154f1097da13d48fdb3200760b3e3da66dcb11, b54a4b373c6f042cab6ee2033246b1c9ecc38974, and ec1a0e215efd27a3b3911aae6df978a80f456a49). For applications unable to upgrade immediately, implement input validation to reject excessively long numeric strings before they reach the NumberToDelimitedConverter, and consider rate-limiting or request size restrictions at the application or reverse proxy level to mitigate ReDoS exploitation. Consult the GitHub advisory at https://github.com/advisories/GHSA-cg4j-q9v8-6v38 for complete details and version mapping.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the NumberToDelimitedConverter component of Ruby on Rails' ActiveSupport library (pkg:rubygems/activesupport), which provides utility functions for number formatting including the insertion of thousands separators. The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), specifically a regex denial of service (ReDoS) condition where the gsub! method with a poorly optimized regular expression exhibits catastrophic backtracking behavior on certain input patterns. When processing long strings of digits, the regex engine enters a state of exponential time complexity, consuming CPU resources proportionally to the square of the input length rather than linearly. This occurs because the regex pattern used for delimiter insertion does not properly handle the alternation and quantifiers in a way that prevents backtracking on non-matching portions of extended numeric strings.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.
Releases
The fixed releases are available at the normal locations.
Executive ViewAI
CVE-2026-33169 presents moderate security risk, a resource exhaustion vulnerability rated CVSS 5.3. Service availability could be impacted. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: implement rate limiting and resource quotas.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise High Availability Extension 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB