CVE-2026-33169
MediumCVSS 5.3Summary
Active Support is a Ruby support library extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub!, which can cause quadratic time complexity on long digit strings. The issue is patched in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.
Risk Assessment
An attacker could supply a long digit string, causing excessive CPU usage and delays in a Ruby on Rails application. This may lead to a partial denial of service.
Recommendation
Update Active Support to version 8.1.2.1, 8.0.4.1, 7.2.3.1, or later. Avoid processing untrusted, very long digit strings through NumberToDelimitedConverter.
Other vulnerabilities in Active Support
See all- CVE-2026-33176High
Active Support (a Ruby library from Rails) before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 accepts strings in scientific notation (e.g. 1e10000) in number helpers, which BigDecimal expands into extremely large decimals. Formatting such a number causes excessive memory allocation and CPU consumption.
- CVE-2026-33170Medium
In Active Support (Ruby on Rails), SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g., via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
- CVE-2023-22796High
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter catastrophic backtracking, causing the process to use large amounts of CPU and memory.
Original NVD description (English source)
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS