# \[CVE-2026-33174\] Possible DoS vulnerability in Active Storage proxy mode via Range requests

**URL:** <https://discuss.rubyonrails.org/t/cve-2026-33174-possible-dos-vulnerability-in-active-storage-proxy-mode-via-range-requests/90908>\
**Category:** Security Announcements\
**Tags:** announcement, security\
**Created:** [March 23, 2026, 9:25pm UTC](https://discuss.rubyonrails.org/t/cve-2026-33174-possible-dos-vulnerability-in-active-storage-proxy-mode-via-range-requests/90908 "2026-03-23T21:25:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhawthorn](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/jhawthorn/32/590_2.png) [@jhawthorn](https://discuss.rubyonrails.org/u/jhawthorn)\
**Post date:** [March 23, 2026, 9:25pm UTC](https://discuss.rubyonrails.org/t/cve-2026-33174-possible-dos-vulnerability-in-active-storage-proxy-mode-via-range-requests/90908/1 "2026-03-23T21:25:39Z")

</div>

### Impact

When serving files through Active Storage’s `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

### Releases

The fixed releases are available at the normal locations.

- CVE-2026-33174
- GHSA-r46p-8f7g-vvvg

## Versions affected

- activestorage \>= 8.1, \< 8.1.2.1 (patched in 8.1.2.1)
- activestorage \>= 8.0, \< 8.0.4.1 (patched in 8.0.4.1)
- activestorage \< 7.2.3.1 (patched in 7.2.3.1)

## Patches

- 8.1 - [https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a.patch](https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a.patch)
- 8.0 - [https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5.patch](https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5.patch)
- 7.2 - [https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b.patch](https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b.patch)