CVE-2026-33658: Rails Active Storage DoS Vulnerability

CVE-2026-33658 Overview

CVE-2026-33658 is a Denial of Service (DoS) vulnerability affecting Active Storage, a component that allows users to attach cloud and local files in Ruby on Rails applications. The vulnerability exists in Active Storage's proxy controller, which fails to limit the number of byte ranges that can be specified in an HTTP Range header. An attacker can craft malicious requests containing thousands of small byte ranges, causing disproportionate CPU usage compared to normal file requests, potentially resulting in service disruption.

Critical Impact

Authenticated attackers can exhaust server CPU resources by sending specially crafted HTTP Range headers with excessive byte ranges, potentially causing denial of service conditions for Rails applications using Active Storage's proxy functionality.

Affected Products

• Ruby on Rails Active Storage versions prior to 8.1.2.1
• Ruby on Rails Active Storage versions prior to 8.0.4.1
• Ruby on Rails Active Storage versions prior to 7.2.3.1

Discovery Timeline

• 2026-03-26 - CVE-2026-33658 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33658

Vulnerability Analysis

This vulnerability is classified as CWE-770: Allocation of Resources Without Limits or Throttling. The core issue lies in Active Storage's proxy controller implementation, which processes HTTP Range header requests without imposing any restrictions on the number of byte ranges that can be specified in a single request.

When a client requests a file through Active Storage's proxy endpoint, the server parses the Range header to determine which portions of the file to serve. Under normal circumstances, Range headers are used for resumable downloads or video streaming. However, the lack of validation on the number of ranges allows an attacker to specify an excessive number of small ranges (potentially thousands), forcing the server to allocate resources for processing each range individually.

The disproportionate CPU consumption occurs because the server must parse, validate, and process each byte range specification, creating significant computational overhead even for small files. This resource exhaustion attack vector requires only authenticated access, as indicated by the attack prerequisites.

Root Cause

The root cause is the absence of input validation and resource limits in the Range header parsing logic within Active Storage's proxy controller. The controller accepts and processes arbitrary numbers of byte range specifications without implementing defensive measures such as:

• Maximum range count limits
• Total request complexity thresholds
• Rate limiting on Range header processing

This allows computationally expensive operations to be triggered by relatively simple HTTP requests.

Attack Vector

The attack is network-based and requires low privileges (authenticated user access). An attacker can exploit this vulnerability by:

1. Identifying an Active Storage proxy endpoint in the target Rails application
2. Crafting an HTTP request with a Range header containing thousands of small, non-overlapping byte ranges
3. Sending the malicious request to the server, triggering excessive CPU consumption during range parsing and processing
4. Repeating the attack to amplify resource exhaustion and potentially cause service degradation or unavailability

The vulnerability mechanism involves sending HTTP Range headers with excessive byte range specifications to Active Storage proxy endpoints. When the server processes these requests, it allocates CPU resources to parse and handle each range individually, leading to resource exhaustion. For detailed technical analysis and exploitation patterns, refer to the GitHub Security Advisory GHSA-p9fm-f462-ggrg.

Detection Methods for CVE-2026-33658

Indicators of Compromise

• HTTP requests to Active Storage proxy endpoints with unusually large or complex Range headers
• Elevated CPU usage on application servers correlated with requests to file serving endpoints
• Abnormally long response times for Active Storage file downloads
• High volume of requests from single sources targeting storage proxy URLs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block HTTP requests with excessive Range header specifications
• Monitor application server CPU utilization and correlate spikes with Active Storage endpoint access logs
• Configure intrusion detection systems (IDS) to alert on HTTP Range headers exceeding typical complexity thresholds
• Review Rails application logs for repeated requests to /rails/active_storage/ proxy paths with unusual patterns

Monitoring Recommendations

• Enable detailed logging for Active Storage proxy controller endpoints to capture Range header contents
• Set up alerting for sustained CPU usage increases on Rails application servers
• Monitor request latency metrics for Active Storage endpoints to identify potential DoS conditions
• Track and baseline normal Range header usage patterns to identify anomalous behavior

How to Mitigate CVE-2026-33658

Immediate Actions Required

• Upgrade Ruby on Rails to patched versions: 8.1.2.1, 8.0.4.1, or 7.2.3.1 immediately
• Audit applications for Active Storage proxy usage and assess exposure
• Implement network-level rate limiting on Active Storage proxy endpoints as a temporary measure
• Review access controls to ensure only necessary users have access to file proxy functionality

Patch Information

The Rails development team has released security patches in the following versions:

• Rails v8.1.2.1
• Rails v8.0.4.1
• Rails v7.2.3.1

Organizations should update their Gemfile to specify the patched version and run bundle update rails to apply the fix. Additional details are available in the GitHub Security Advisory GHSA-p9fm-f462-ggrg and the RubySec Advisory Database.

Workarounds

• Deploy a reverse proxy or WAF rule to limit the number of Range specifications accepted in HTTP requests
• Implement custom Rack middleware to validate and restrict Range header complexity before requests reach Rails
• Consider serving files directly from cloud storage (S3, GCS) rather than through the Active Storage proxy if application architecture permits
• Apply rate limiting at the load balancer or CDN level for Active Storage proxy endpoints

# Update Rails to patched version
# In your Gemfile, specify the patched version:
gem 'rails', '>= 7.2.3.1'

# Then run bundle update
bundle update rails

# Verify the installed version
bundle show rails