EUVD-2026-16426Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate-to-high real-world risk despite the absence of a CVSS score and EPSS metric in the advisory data. The attack vector is network-based with low complexity (a simple HTTP request can trigger the issue), requiring no authentication or user interaction. The technical impact is availability denial, which affects service continuity for all users. The fact that this is reported by the official Rails security team (github.com/rails/rails) and published via GitHub Security Advisory (GHSA-p9fm-f462-ggrg) indicates this is a confirmed, non-theoretical issue. The vulnerability is likely automatable, as attackers can craft Range headers programmatically. Without KEV confirmation or public POC data in the provided intelligence, this appears to be a responsibly-disclosed vulnerability in the pre-patch window. Organizations running ActiveStorage should prioritize patching based on exposure: public-facing Rails applications serving files through Active Storage face immediate DoS risk. |
| Exploit ScenarioDerived | An attacker crafts an HTTP GET request to a file served through Rails Active Storage with a Range header containing thousands of byte-range specifications (e.g., Range: bytes=0-1,2-3,4-5,...,9998-9999). The vulnerable proxy controller processes each range without throttling, causing the server CPU to spike dramatically. If the application runs on limited resources (e.g., small EC2 instance, containerized environment), this single request can saturate CPU, causing the application to become unresponsive or crash, affecting all legitimate users. No special authentication or exploit code is required; a simple curl command or Python requests script can generate the malicious Range header. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Rails Active Storage's proxy controller fails to limit the number of byte ranges accepted in HTTP Range headers, allowing attackers to craft requests with thousands of small ranges that consume disproportionate CPU resources compared to legitimate file requests. This denial-of-service vulnerability affects Ruby on Rails applications using the ActiveStorage library (pkg:rubygems/activestorage). An attacker can trigger resource exhaustion by sending Range requests with many byte ranges, potentially rendering the application unavailable to legitimate users.
RemediationAI
Upgrade the ActiveStorage gem to the fixed version released by the Rails team; consult https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg for specific patched versions and run bundle update activestorage in your Rails application. As an interim mitigation if patching is delayed, implement HTTP request filtering at the reverse proxy or web server level (e.g., nginx, Apache) to reject Range headers with excessive byte-range specifications (e.g., more than 10-20 ranges per request), or temporarily disable Range request support if not critical for your use case. Additionally, monitor CPU usage on Active Storage proxy endpoints for anomalous patterns indicative of range-based DoS attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Rails Active Storage, a Ruby library for handling file uploads and attachments in Rails applications (CPE: pkg:rubygems/activestorage). The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), which describes the failure to implement proper input validation and resource constraints. The HTTP Range header, defined in RFC 7233, allows clients to request specific byte ranges of a file; however, Active Storage's proxy controller lacks validation to restrict the number of ranges per request. When a client sends a malformed or malicious Range header specifying thousands of small byte ranges, the server attempts to process each range individually, leading to CPU exhaustion and algorithmic complexity attacks that degrade far beyond the cost of a normal full-file request.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.
Releases
The fixed releases are available at the normal locations.
Executive ViewAI
CVE-2026-33658 is a low-severity vulnerability (CVSS 2.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB