GHSA-p9fm-f462-ggrg

Source

https://github.com/advisories/GHSA-p9fm-f462-ggrg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p9fm-f462-ggrg/GHSA-p9fm-f462-ggrg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p9fm-f462-ggrg

Aliases

CVE-2026-33658

Downstream

CGA (50)

Published

2026-03-25T21:04:50Z

Modified

2026-09-10T03:50:40Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Details

Impact

Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher thwin_htet.

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-25T21:04:50Z",
    "nvd_published_at":  "2026-03-26T22:16:29Z",
    "severity":  "LOW"
}

References

Affected packages

RubyGems / activestorage

Package

Name: activestorage
Purl: pkg:gem/activestorage

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.1.0

Fixed

8.1.2.1

Affected versions

8.*

8.1.0

8.1.1

8.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p9fm-f462-ggrg/GHSA-p9fm-f462-ggrg.json"

RubyGems / activestorage

Package

Name: activestorage
Purl: pkg:gem/activestorage

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0

Fixed

8.0.4.1

Affected versions

8.*

8.0.0

8.0.0.1

8.0.1

8.0.2

8.0.2.1

8.0.3

8.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p9fm-f462-ggrg/GHSA-p9fm-f462-ggrg.json"

RubyGems / activestorage

Package

Name: activestorage
Purl: pkg:gem/activestorage

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.2.3.1

Affected versions

0.*

0.1

5.*

5.2.0.beta1

5.2.0.beta2

5.2.0.rc1

5.2.0.rc2

5.2.0

5.2.1.rc1

5.2.1

5.2.1.1

5.2.2.rc1

5.2.2

5.2.2.1

5.2.3.rc1

5.2.3

5.2.4.rc1

5.2.4

5.2.4.1

5.2.4.2

5.2.4.3

5.2.4.4

5.2.4.5

5.2.4.6

5.2.5

5.2.6

5.2.6.1

5.2.6.2

5.2.6.3

5.2.7

5.2.7.1

5.2.8

5.2.8.1

6.*

6.0.0.beta1

6.0.0.beta2

6.0.0.beta3

6.0.0.rc1

6.0.0.rc2

6.0.0

6.0.1.rc1

6.0.1

6.0.2.rc1

6.0.2.rc2

6.0.2

6.0.2.1

6.0.2.2

6.0.3.rc1

6.0.3

6.0.3.1

6.0.3.2

6.0.3.3

6.0.3.4

6.0.3.5

6.0.3.6

6.0.3.7

6.0.4

6.0.4.1

6.0.4.2

6.0.4.3

6.0.4.4

6.0.4.5

6.0.4.6

6.0.4.7

6.0.4.8

6.0.5

6.0.5.1

6.0.6

6.0.6.1

6.1.0.rc1

6.1.0.rc2

6.1.0

6.1.1

6.1.2

6.1.2.1

6.1.3

6.1.3.1

6.1.3.2

6.1.4

6.1.4.1

6.1.4.2

6.1.4.3

6.1.4.4

6.1.4.5

6.1.4.6

6.1.4.7

6.1.5

6.1.5.1

6.1.6

6.1.6.1

6.1.7

6.1.7.1

6.1.7.2

6.1.7.3

6.1.7.4

6.1.7.5

6.1.7.6

6.1.7.7

6.1.7.8

6.1.7.9

6.1.7.10

7.*

7.0.0.alpha1

7.0.0.alpha2

7.0.0.rc1

7.0.0.rc2

7.0.0.rc3

7.0.0

7.0.1

7.0.2

7.0.2.1

7.0.2.2

7.0.2.3

7.0.2.4

7.0.3

7.0.3.1

7.0.4

7.0.4.1

7.0.4.2

7.0.4.3

7.0.5

7.0.5.1

7.0.6

7.0.7

7.0.7.1

7.0.7.2

7.0.8

7.0.8.1

7.0.8.2

7.0.8.3

7.0.8.4

7.0.8.5

7.0.8.6

7.0.8.7

7.0.10

7.1.0.beta1

7.1.0.rc1

7.1.0.rc2

7.1.0

7.1.1

7.1.2

7.1.3

7.1.3.1

7.1.3.2

7.1.3.3

7.1.3.4

7.1.4

7.1.4.1

7.1.4.2

7.1.5

7.1.5.1

7.1.5.2

7.1.6

7.2.0.beta1

7.2.0.beta2

7.2.0.beta3

7.2.0.rc1

7.2.0

7.2.1

7.2.1.1

7.2.1.2

7.2.2

7.2.2.1

7.2.2.2

7.2.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p9fm-f462-ggrg/GHSA-p9fm-f462-ggrg.json"