CVE-2026-33176: Rails Active Support has a possible DoS vulnerability in its number helpers
Impact Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.
Releases The fixed releases are available at the normal locations.
Other sources
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which BigDecimal expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33176?
CVE-2026-33176 is categorized as a denial of service (DoS) vulnerability that affects Rails Active Support's number helpers.
How do I fix CVE-2026-33176?
To fix CVE-2026-33176, upgrade to Active Support version 7.2.3.1, 8.0.4.1, or 8.1.2.1 or later.
What software is affected by CVE-2026-33176?
CVE-2026-33176 affects all versions of Rails Active Support prior to 7.2.3.1 and versions between 8.0.0.beta1 - 8.0.4.1 and 8.1.0.beta1 - 8.1.2.1.
Can CVE-2026-33176 be exploited remotely?
Yes, CVE-2026-33176 can potentially be exploited remotely, allowing an attacker to craft inputs that provoke a DoS condition.
What measures can be taken to mitigate CVE-2026-33176?
To mitigate CVE-2026-33176, ensure proper input validation on number helpers to handle scientific notation safely.