GHSA-CG4J-Q9V8-6V38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

🗓️ 23 Mar 2026 20:52:40Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Rails Active Support number_to_delimited has a ReDoS risk due to regex gsub causing quadratic time on long digit strings.

Reporter	Title	Published	Views	Family All 35
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been addressed in IBM Aspera Shares	14 May 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator	16 Apr 202621:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affects IBM License Metric Tool v9	27 May 202613:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Active Support affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise WebApps	29 Apr 202618:41	–	ibm
ATTACKERKB	CVE-2026-33169	23 Mar 202623:07	–	attackerkb
BDU FSTEC	The vulnerability of the activesupport component in the Ruby on Rails software framework allows a hacker to trigger a service failure.	25 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33169 vulnerabilities	25 Mar 202607:23	–	cgr
Circl	CVE-2026-33169	24 Mar 202600:07	–	circl
CNNVD	Rails 安全漏洞	23 Mar 202600:00	–	cnnvd

Source	Link
github	www.github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33169
github	www.github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
github	www.github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
github	www.github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
github	www.github.com/rails/rails
github	www.github.com/rails/rails/releases/tag/v7.2.3.1
github	www.github.com/rails/rails/releases/tag/v8.0.4.1
github	www.github.com/rails/rails/releases/tag/v8.1.2.1
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33169.yml

13 May 2026 16:39Current

6.5Medium risk

Vulners AI Score6.5

CVSS 46.9

EPSS0.00498