CVE-2026-33169: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Impact NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.
Releases The fixed releases are available at the normal locations.
Other sources
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33169?
CVE-2026-33169 is considered a moderate severity vulnerability due to the potential for quadratic time complexity on long digit strings.
How do I fix CVE-2026-33169?
To fix CVE-2026-33169, update the activesupport package to version 7.2.3.1 or above, or to versions 8.0.4.1 or 8.1.2.1.
Which versions of activesupport are affected by CVE-2026-33169?
CVE-2026-33169 affects versions of activesupport prior to 7.2.3.1, as well as versions between 8.0.0.beta1 and 8.0.4.1, and between 8.1.0.beta1 and 8.1.2.1.
What is the primary impact of CVE-2026-33169?
The primary impact of CVE-2026-33169 is performance degradation due to quadratic time complexity during the processing of long digit strings.
Where can I find fixed releases for CVE-2026-33169?
Fixed releases for CVE-2026-33169 are available on RubyGems from the standard locations for activesupport.