CVE-2026-33174

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

• CWE-789

• https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5Patch
• https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92aPatch
• https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229bPatch
• https://github.com/rails/rails/releases/tag/v7.2.3.1Release Notes
• https://github.com/rails/rails/releases/tag/v8.0.4.1Release Notes
• https://github.com/rails/rails/releases/tag/v8.1.2.1Release Notes
• https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvgVendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33169Active Support is a toolkit of support libraries and Ruby co…5.3
• CVE-2026-3317Reflected Cross-Site Scripting (XSS) vulnerability in Naviga…5.1
• CVE-2026-33170Active Support is a toolkit of support libraries and Ruby co…6.1
• CVE-2026-33171Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-33172Statamic is a Laravel and Git powered content management sys…8.7
• CVE-2026-33173Active Storage allows users to attach cloud and local files …5.3
• CVE-2026-33175OAuthenticator is software that allows OAuth2 identity provi…8.8
• CVE-2026-33176Active Support is a toolkit of support libraries and Ruby co…7.5
• CVE-2026-33177Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-33179libfuse is the reference implementation of the Linux FUSE. F…5.5
• CVE-2026-3318Open redirection vulnerability in the latest demo version of…5.3
• CVE-2026-33180HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5