Rails: Active Support: Active Support: Denial of Service via large scientific notation strings

🗓️ 07 May 2026 17:09:35Reported by RedHatType

DoS in Rails Active Support from large scientific notation strings causing BigDecimal expansion and resource exhaustion.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been addressed in IBM Aspera Shares	14 May 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator	16 Apr 202621:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affects IBM License Metric Tool v9	27 May 202613:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise WebApps	29 Apr 202618:41	–	ibm
ATTACKERKB	CVE-2026-33176	23 Mar 202623:29	–	attackerkb
BDU FSTEC	The vulnerability of the activesupport component in the Ruby on Rails software framework allows a hacker to trigger a service failure.	25 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33176 vulnerabilities	25 Mar 202607:23	–	cgr
Circl	CVE-2026-33176	24 Mar 202600:01	–	circl
CNNVD	Rails 安全漏洞	23 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33176	23 Mar 202623:29	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	noarch	rubygem-activesupport	7.0.8.7-2.el9sat	rubygem-activesupport-7.0.8.7-2.el9sat.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-33176
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
github	www.github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
github	www.github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
github	www.github.com/rails/rails/releases/tag/v7.2.3.1
github	www.github.com/rails/rails/releases/tag/v8.0.4.1
github	www.github.com/rails/rails/releases/tag/v8.1.2.1
github	www.github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33176

15 Jul 2026 03:13Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.0061

SSVC