CVE-2026-33176
HighCVSS 7.5Summary
Active Support (a Ruby library from Rails) before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 accepts strings in scientific notation (e.g. 1e10000) in number helpers, which BigDecimal expands into extremely large decimals. Formatting such a number causes excessive memory allocation and CPU consumption.
Risk Assessment
An attacker can trigger a Denial of Service (DoS) by submitting a crafted numeric value, exhausting server resources.
Recommendation
Update Active Support to version 8.1.2.1, 8.0.4.1, or 7.2.3.1 (or later). Validate input passed to number helpers.
Other vulnerabilities in Active Support
See all- CVE-2026-33170Medium
In Active Support (Ruby on Rails), SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g., via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
- CVE-2026-33169Medium
Active Support is a Ruby support library extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub!, which can cause quadratic time complexity on long digit strings. The issue is patched in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.
- CVE-2023-22796High
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter catastrophic backtracking, causing the process to use large amounts of CPU and memory.
Original NVD description (English source)
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS