Red Hat CVE-2026-33176

The vulnerability exists in Ruby on Rails' ActiveSupport library (pkg:rubygems/activesupport), which provides utility functions for number formatting and conversion. Specifically, the number helper methods accept string inputs containing scientific notation without proper validation before conversion and formatting operations. When a string like '1e10000' is processed, the underlying conversion logic expands the exponent into its full decimal representation, creating a string potentially millions of characters long. This represents a classic CWE-400 (Uncontrolled Resource Consumption) vulnerability where input validation fails to prevent algorithmic complexity attacks. The root cause is the lack of bounds checking on the exponent value before expansion, allowing attackers to craft inputs that trigger quadratic or worse computational complexity during number formatting.