Skip to main content

Red Hat CVE-2026-33176

HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-03-23 https://github.com/rails/rails
Denial Of Service Red Hat Suse
7.5
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send HTTP request with scientific notation string
  2. Exploit
    Number helper converts to decimal representation
  3. Execution
    Memory allocation exhausts system resources
  4. Impact
    Application becomes unresponsive

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote unauthenticated attacker sending strings with scientific notation (e.g., '1e10000') to Active Support number helpers. No user interaction required. Affects default configurations accepting numeric input without validation.
Impact

While CVSS and EPSS scores are not provided in the advisory data, the vulnerability presents moderate to high real-world risk due to several factors: the attack vector is network-based (ActiveSupport processes user-supplied input in web applications), the attack complexity is low (simple string construction), and no authentication or privileges are required to trigger the condition. The vulnerability is classified as a denial of service tag, indicating the primary impact is service unavailability rather than data compromise. The availability of patches across multiple recent Rails versions (7.2.3.1, 8.0.4.1, 8.1.2.1) and direct GitHub commits indicate this was treated as a priority issue by the Rails security team. Exploitation is automatable and requires no user interaction, making this a legitimate concern for production Rails applications handling untrusted input. The lack of KEV/POC data in the references does not diminish the risk, as DoS vulnerabilities in number formatting are straightforward to trigger once the mechanism is understood.
Exploit ScenarioDerived

An attacker targeting a Rails web application with untrusted user input could craft a malicious request containing a number helper parameter with extreme scientific notation such as '1e100000'. When the application processes this input through ActiveSupport's number formatting methods, the exponent expands into a decimal string requiring gigabytes of memory allocation and significant CPU cycles for formatting operations. This causes the application server to exhaust available memory and CPU, making the service unavailable to legitimate users. The attack requires only HTTP network access and can be automated to send multiple such requests, amplifying the denial of service impact.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

Rails ActiveSupport number helpers contain a denial of service vulnerability where strings with scientific notation (e.g., '1e10000') are improperly converted and expanded into extremely large decimal representations, causing excessive memory allocation and CPU consumption during string formatting. The vulnerability affects ActiveSupport across multiple Rails versions prior to 7.2.3.1, 8.0.4.1, and 8.1.2.1. An attacker can exploit this by providing maliciously crafted scientific notation strings to trigger resource exhaustion and deny service to legitimate users.

RemediationAI

Upgrade Rails and ActiveSupport to the patched versions immediately: Rails 7.2.3.1 or later, Rails 8.0.4.1 or later, or Rails 8.1.2.1 or later. The patches are available from the normal Rails distribution channels and GitHub releases at https://github.com/rails/rails/releases/tag/v7.2.3.1, https://github.com/rails/rails/releases/tag/v8.0.4.1, and https://github.com/rails/rails/releases/tag/v8.1.2.1. As a temporary mitigation for applications unable to patch immediately, implement input validation on any user-supplied strings before passing them to number helper methods, specifically rejecting or sanitizing strings containing scientific notation (patterns like '1e' followed by large digits). Additionally, apply rate limiting and request size limits at the application or reverse proxy level to prevent resource exhaustion attacks.

Affected Packages

rubygems activesupport fix: 7.2.3.1, 8.0.4.1, 8.1.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in Ruby on Rails' ActiveSupport library (pkg:rubygems/activesupport), which provides utility functions for number formatting and conversion. Specifically, the number helper methods accept string inputs containing scientific notation without proper validation before conversion and formatting operations. When a string like '1e10000' is processed, the underlying conversion logic expands the exponent into its full decimal representation, creating a string potentially millions of characters long. This represents a classic CWE-400 (Uncontrolled Resource Consumption) vulnerability where input validation fails to prevent algorithmic complexity attacks. The root cause is the lack of bounds checking on the exponent value before expansion, allowing attackers to craft inputs that trigger quadratic or worse computational complexity during number formatting.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 23, 2026 - 21:15 nvd
Patch available
CVE Published
Mar 23, 2026 - 21:15 nvd
HIGH 7.5

DescriptionGitHub Advisory

Impact

Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

Executive ViewAI

Why It Matters

CVE-2026-33176 presents notable security risk, a resource exhaustion vulnerability rated CVSS 7.5. Exploitation could cause service disruption or denial of service, impacting availability for legitimate users. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)GitHub Advisory

pkg:rubygems/activesupport
pkg:rubygems/activesupport
pkg:rubygems/activesupport

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed

References

Advisories & patches
PATCH https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb PATCH https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a PATCH https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856 ADVISORY https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9 ADVISORY https://vuldb.com/vuln/352641 REF https://github.com/advisories/GHSA-2j26-frm8-cmj9 REF https://github.com/rails/rails/releases/tag/v7.2.3.1 REF https://github.com/rails/rails/releases/tag/v8.0.4.1 REF https://github.com/rails/rails/releases/tag/v8.1.2.1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy