[CVE-2026-33658] Possible DoS vulnerability in Active Storage proxy mode via multi-range requests

[jhawthorn (John Hawthorn)]

Impact

Active Storage’s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

• CVE-2026-33658
• GHSA-p9fm-f462-ggrg

Versions affected

• activestorage >= 8.1, < 8.1.2.1 (patched in 8.1.2.1)
• activestorage >= 8.0, < 8.0.4.1 (patched in 8.0.4.1)
• activestorage < 7.2.3.1 (patched in 7.2.3.1)

Patches

• 8.1 - https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06.patch
• 8.0 - https://github.com/rails/rails/commit/d7da4ef03f99035fba5add8828646f1e9173549c.patch
• 7.2 - https://github.com/rails/rails/commit/b8a1665824a43d71cd6406cf9adcae842ceb1c22.patch