Skip to main content

Red Hat CVE-2026-33174

HIGH
Memory Allocation with Excessive Size Value (CWE-789)
2026-03-23 https://github.com/rails/rails
Information Disclosure Red Hat Suse
7.5
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send HTTP request with large Range header
  2. Exploit
    ProxyController loads entire byte range into memory
  3. Execution
    Server memory exhausted
  4. Impact
    Service becomes unavailable

Vulnerability Assessment

Weakness
CWE
CWE-789
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
Exploitation Conditions

Rails application using Active Storage with Blobs::ProxyController enabled serving files. Attacker sends HTTP Range request with large/unbounded byte range (e.g., bytes=0-) to any file endpoint. No authentication required; default Active Storage configurations are vulnerable.
Impact

The real-world risk is moderate-to-high despite the absence of a published CVSS score and EPSS data. The attack vector is network-based and requires no authentication or user interaction, making it highly accessible. The complexity is low—any attacker with network access can craft a malicious Range header and trigger the vulnerability. The technical impact is denial of service through resource exhaustion rather than confidentiality or integrity compromise, which limits business impact but directly threatens availability. The absence of reported active exploitation or public proof-of-concept code is noteworthy, but the simplicity of the attack mechanics and the public disclosure through official Rails channels means motivated adversaries can easily weaponize it. The availability of patches across multiple Rails versions (7.2.3.1, 8.0.4.1, 8.1.2.1) with corresponding GitHub commits indicates vendor responsiveness and reduces priority for organizations that practice timely patching. Organizations running exposed Active Storage endpoints without rate limiting or request size controls face elevated risk.
Exploit ScenarioDerived

An attacker sends a specially crafted HTTP GET request to an Active Storage file endpoint with a Range header such as 'Range: bytes=0-' (requesting the entire file from offset 0 with no upper bound) against a large file hosted on a vulnerable Rails application. The Blobs::ProxyController loads the entire file into memory to satisfy the Range request, allocating gigabytes of RAM on each request. By issuing multiple such requests in parallel or in rapid succession, the attacker exhausts available server memory, causing the application to slow drastically, crash, or become unresponsive to legitimate users. No authentication is required and the request can originate from anywhere with network access to the application.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

Rails Active Storage's Blobs::ProxyController loads entire requested byte ranges into memory before transmission, allowing remote unauthenticated attackers to exhaust server memory and cause denial of service by sending requests with large or unbounded Range headers. This vulnerability affects systems using Active Storage for file serving and requires no user interaction or authentication to exploit. A patch is available.

Earlier versions of this analysis (1)
v1 Mar 23, 2026 - 21:15 CVSS 7.5

A memory exhaustion denial-of-service vulnerability exists in Ruby on Rails' Active Storage Blobs::ProxyController where unbounded or large Range header requests cause the server to load entire file byte ranges into memory before transmission. Rails applications using Active Storage for file serving are affected across multiple versions, and an unauthenticated attacker can trigger memory exhaustion by issuing crafted Range requests against any exposed file endpoint. Patches are available and widely documented through official Rails security advisories; no active exploitation in the wild has been reported, but the simplicity of the attack vector makes this a moderate-to-high priority for affected deployments.

RemediationAI

Immediately upgrade Ruby on Rails to version 7.2.3.1, 8.0.4.1, 8.1.2.1, or later; patches are available from the vendor at the normal distribution channels (rubygems.org and GitHub releases at https://github.com/rails/rails/releases). The fix is implemented across three commits (2cd933c366b777f873d4d590127da2f4a25e4ba5, 42012eaaa88dfc7d0030161b2bc8074a7bbce92a, and 8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b) that modify the Range request handling to stream data with bounded memory allocation. For organizations unable to patch immediately, implement network-level mitigations such as rate limiting on file-serving endpoints, request size restrictions at the reverse proxy or load balancer level, and IP whitelisting where feasible. Monitor memory usage and connection counts on Active Storage endpoints and configure alerting for anomalous patterns.

Affected Packages

rubygems activestorage fix: 7.2.3.1, 8.0.4.1, 8.1.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Ruby on Rails' Active Storage library (pkg:rubygems/activestorage), specifically the Blobs::ProxyController component responsible for serving user-uploaded files over HTTP. The underlying issue is classified as CWE-789 (Memory Allocation with Excessive Size Value), a weakness where application code fails to validate or bound the size of memory allocations requested by user input. When a client sends an HTTP Range header (RFC 7233) such as 'bytes=0-' or 'bytes=0-999999999', the controller loads the entire requested byte range into memory as a buffer before streaming the response to the client. This design fails to implement streaming or chunked processing that would limit memory consumption to a small, constant buffer size regardless of file size, instead proportionally allocating memory to match the requested range.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 5.9 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 23, 2026 - 21:15 nvd
Patch available
CVE Published
Mar 23, 2026 - 21:08 nvd
HIGH 7.5

DescriptionGitHub Advisory

Impact

When serving files through Active Storage's Blobs::ProxyController, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. bytes=0-) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

Releases

The fixed releases are available at the normal locations.

Executive ViewAI

Why It Matters

CVE-2026-33174 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)GitHub Advisory

pkg:rubygems/activestorage
pkg:rubygems/activestorage
pkg:rubygems/activestorage

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-65315 HIGH POC
8.7
CVE-2026-59204 HIGH POC
8.7
CVE-2026-91752 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed

References

Advisories & patches
PATCH https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5 PATCH https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a PATCH https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b ADVISORY https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg ADVISORY https://vuldb.com/vuln/352628 REF https://github.com/advisories/GHSA-r46p-8f7g-vvvg REF https://github.com/rails/rails/releases/tag/v7.2.3.1 REF https://github.com/rails/rails/releases/tag/v8.0.4.1 REF https://github.com/rails/rails/releases/tag/v8.1.2.1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy