# \[CVE-2026-33658\] Possible DoS vulnerability in Active Storage proxy mode via multi-range requests

**URL:** <https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906>\
**Category:** Security Announcements\
**Tags:** announcement, security\
**Created:** [March 23, 2026, 9:25pm UTC](https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906 "2026-03-23T21:25:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhawthorn](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/jhawthorn/32/590_2.png) [@jhawthorn](https://discuss.rubyonrails.org/u/jhawthorn)\
**Post date:** [March 23, 2026, 9:25pm UTC](https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906/1 "2026-03-23T21:25:29Z")

</div>

### Impact

Active Storage’s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.

### Releases

The fixed releases are available at the normal locations.

- CVE-2026-33658
- GHSA-p9fm-f462-ggrg

## Versions affected

- activestorage \>= 8.1, \< 8.1.2.1 (patched in 8.1.2.1)
- activestorage \>= 8.0, \< 8.0.4.1 (patched in 8.0.4.1)
- activestorage \< 7.2.3.1 (patched in 7.2.3.1)

## Patches

- 8.1 - [https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06.patch](https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06.patch)
- 8.0 - [https://github.com/rails/rails/commit/d7da4ef03f99035fba5add8828646f1e9173549c.patch](https://github.com/rails/rails/commit/d7da4ef03f99035fba5add8828646f1e9173549c.patch)
- 7.2 - [https://github.com/rails/rails/commit/b8a1665824a43d71cd6406cf9adcae842ceb1c22.patch](https://github.com/rails/rails/commit/b8a1665824a43d71cd6406cf9adcae842ceb1c22.patch)