CVE-2026-33658: Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Impact Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.
Releases The fixed releases are available at the normal locations.
Other sources
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33658?
CVE-2026-33658 has been classified as a high severity DoS vulnerability due to excessive CPU usage from multi-range requests.
How do I fix CVE-2026-33658?
To fix CVE-2026-33658, upgrade Active Storage to version 7.2.3.1, 8.0.4.1, or 8.1.2.1 or later.
Which versions of Active Storage are affected by CVE-2026-33658?
The versions of Active Storage affected by CVE-2026-33658 are prior to 7.2.3.1, 8.0.0 to 8.0.4.1, and 8.1.0 to 8.1.2.1.
What impact does CVE-2026-33658 have on applications?
CVE-2026-33658 can cause significant performance degradation in applications using Active Storage when handling multi-range requests.
Is there a workaround for CVE-2026-33658?
Currently, there are no official workarounds for CVE-2026-33658 other than upgrading to the fixed versions.