CVE-2023-22796
HighCVSS 7.5Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter catastrophic backtracking, causing the process to use large amounts of CPU and memory.
Risk Assessment
An attacker can exhaust resources and cause a denial of service of an application using Active Support.
Recommendation
Upgrade Active Support to version 6.1.7.1, 7.0.4.1 or later.
Other vulnerabilities in Active Support
See all- CVE-2026-33176High
Active Support (a Ruby library from Rails) before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 accepts strings in scientific notation (e.g. 1e10000) in number helpers, which BigDecimal expands into extremely large decimals. Formatting such a number causes excessive memory allocation and CPU consumption.
- CVE-2026-33170Medium
In Active Support (Ruby on Rails), SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g., via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
- CVE-2026-33169Medium
Active Support is a Ruby support library extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub!, which can cause quadratic time complexity on long digit strings. The issue is patched in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.
Original NVD description (English source)
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS