CVE-2026-33174: Rails Active Storage DoS Vulnerability via Range Requests
Summary
CVE-2026-33174: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests. Affects activestorage across 3 version ranges.
< 7.2.3.1
>= 8.0.0.beta1, < 8.0.4.1
>= 8.1.0.beta1, < 8.1.2.1
Fixed in 7.2.3.1, 8.0.4.1 or 8.1.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rails Active Storage is a component of the Ruby on Rails framework that facilitates file uploads and management. It allows developers to store files in various cloud services or local storage, providing a seamless interface for handling file attachments in applications. However, a recent vulnerability has been identified in its Blobs::ProxyController, which can lead to potential denial of service (DoS) attacks when handling specific Range requests.
Vulnerability Detail
The vulnerability arises from the way Active Storage's Blobs::ProxyController processes Range requests. When a request is made with a large or unbounded Range header, such as 'bytes=0-', the controller loads the entire requested byte range into memory. This can lead to excessive memory allocation proportional to the file size, potentially causing memory exhaustion and resulting in a denial of service (DoS) condition. The vulnerability is classified under CWE-789, which pertains to improper control of a resource through its lifetime.
How To Fix
Latest published version: 8.1.4 as of 22 Oct 2026
gem install activestorage -v 8.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.2.3.17.2.3.1gem install activestorage -v 7.2.3.1 -
>= 8.0.0.beta1, < 8.0.4.18.0.4.1gem install activestorage -v 8.0.4.1 -
>= 8.1.0.beta1, < 8.1.2.18.1.2.1gem install activestorage -v 8.1.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the size of the Range requests your application accepts. Implementing a middleware that checks the Range header and rejects requests that exceed a certain size can help mitigate the risk until the package is updated.
Conclusion
In summary, the CVE-2026-33174 vulnerability in Rails Active Storage poses a risk of denial of service due to improper handling of Range requests. It is crucial to update to the patched versions to mitigate this risk. Additionally, temporary workarounds can be implemented to enhance security until the update is applied.
See every vulnerability recorded for activestorage →
FAQ
The vulnerability allows for potential denial of service (DoS) attacks due to excessive memory allocation when processing large or unbounded Range requests.
Versions 8.1.0.beta1 to 8.1.2.1, 8.0.0.beta1 to 8.0.4.1, and all versions up to 7.2.3.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
If an immediate update is not possible, implement a middleware to limit the size of Range requests accepted by your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for activestorage.
