CVE-2026-33174
Rubyonrails Rails ≤ 7.2.3.1
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33174 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Rubyonrails Rails. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-6 (Resource Availability) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33174 is a denial-of-service vulnerability in Active Storage, a component of Ruby on Rails applications that enables attaching cloud and local files. In versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1, when files are served through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before transmission. A specially crafted HTTP request with a large or unbounded Range header, such as "bytes=0-", triggers allocation of memory proportional to the file size, potentially exhausting server resources.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable remotely over the network with low complexity, no authentication or user interaction required. Any unauthenticated attacker who can reach the Rails application's file-serving endpoint in proxy mode can send repeated or concurrent requests with malicious Range headers, causing progressive memory exhaustion and disrupting service availability. The impact is limited to availability, with no confidentiality or integrity effects.
Patches addressing this issue are available in Rails Active Storage versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, as detailed in the corresponding GitHub release tags and commit histories. Security practitioners should upgrade affected applications to these versions to mitigate the risk, and review configurations to ensure proxy delivery mode is not unnecessarily exposed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14628
Vulnerability Data
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory…
more
before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly rejects or bounds untrusted size values before any allocation occurs.
Resource quotas and priority allocation limit the system-wide impact of an oversized request.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.
Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.