Red Hat CVE-2026-33174

The vulnerability resides in Ruby on Rails' Active Storage library (pkg:rubygems/activestorage), specifically the Blobs::ProxyController component responsible for serving user-uploaded files over HTTP. The underlying issue is classified as CWE-789 (Memory Allocation with Excessive Size Value), a weakness where application code fails to validate or bound the size of memory allocations requested by user input. When a client sends an HTTP Range header (RFC 7233) such as 'bytes=0-' or 'bytes=0-999999999', the controller loads the entire requested byte range into memory as a buffer before streaming the response to the client. This design fails to implement streaming or chunked processing that would limit memory consumption to a small, constant buffer size regardless of file size, instead proportionally allocating memory to match the requested range.