GHSA-V569-HP3G-36WR vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, kube-fluentd-operator, gitlab-cng, pact-broker-docker, pact-broker-docker-fips, ruby3.3-rack, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, ruby3.4-rack...

GHSA-V6X5-CG8R-VV6X vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, pact-broker-docker-fips, kube-fluentd-operator, pact-broker-docker, ruby3.4-rails...

GHSA-53P3-C7VP-4MCC vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby3.3-rails, ruby4.0-rails...

GHSA-53P3-C7VP-4MCC vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails...

Arbitrary Code Injection

Overview lodash-rails is a lodash for the Rails asset pipeline. Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrary code at template compilation time by injecting...

GHSA-P9FM-F462-GGRG vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

CVE-2026-33658 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

GHSA-2J22-PR5W-6GQ8 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

CVE-2026-33658 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-2J22-PR5W-6GQ8 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails...

Rails Active Storage Has A Possible DoS Vulnerability In Proxy Mode Via Multi-range Requests

Impact Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Releases The fixed...

Linux Distros Unpatched Vulnerability : CVE-2026-33658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy...

Linux Distros Unpatched Vulnerability : CVE-2026-33167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does no...

CVE-2026-33868 Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encode...

DEBIAN-CVE-2026-33658

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate C...

UBUNTU-CVE-2026-33658

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate C...

EUVD-2026-16426

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate C...

CVE-2026-33658

Ruby on Rails Active Storage is affected by a DoS vulnerability in the proxy mode where the HTTP Range header can include thousands of small ranges, causing disproportionate CPU usage. This impacts Rails applications using Active Storage prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1. A patch ha...

CVE-2026-33658 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate C...

CVE-2026-33658 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate C...