Red Hat CVE-2026-33169

The vulnerability resides in the NumberToDelimitedConverter component of Ruby on Rails' ActiveSupport library (pkg:rubygems/activesupport), which provides utility functions for number formatting including the insertion of thousands separators. The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), specifically a regex denial of service (ReDoS) condition where the gsub! method with a poorly optimized regular expression exhibits catastrophic backtracking behavior on certain input patterns. When processing long strings of digits, the regex engine enters a state of exponential time complexity, consuming CPU resources proportionally to the square of the input length rather than linearly. This occurs because the regex pattern used for delimiter insertion does not properly handle the alternation and quantifiers in a way that prevents backtracking on non-matching portions of extended numeric strings.