CVE-2026-33176mediumCWE-400CWE-770

CVE-2026-33176: falha de média gravidade em rails activesupport

Rails Active Support has a possible DoS vulnerability in its number helpers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar activesupport+ Monitorar rails

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.6epss 0.9%
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Produtos afetados
rails · activesupport
CVEs relacionadas — rails activesupport

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33169MEDIUMRails Active Support has a possible ReDoS vulnerability in number_to_delimitedEPSS 0.7%CVE-2026-33170MEDIUMRails Active Support has a possible XSS vulnerability in SafeBuffer#%EPSS 0.3%