Medium
Rails Active Support has a possible DoS vulnerability in its number helpers
Type: advisorySources: OSV
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-33176
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 09:06 UTC · Revision 1
Source evidence
Rails Active Support has a possible DoS vulnerability in its number helpers
core-osv · Original sourcePublished 23 Mar 2026, 23:29 UTC
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
osv:CVE-2026-33176
Complete source record
{
"id": "878c1bab5de4a022e9dd03f5781fed3822f167c4ccc5fde6f42609155cc2b77a",
"url": "https://osv.dev/vulnerability/CVE-2026-33176",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Rails Active Support has a possible DoS vulnerability in its number helpers",
"summary": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.",
"evidence": "osv:CVE-2026-33176",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-33176",
"aliases": [
"CVE-2026-33176",
"GHSA-2j26-frm8-cmj9"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rails/rails",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ba76fca032a66f3716ca8a661c9ddb006acaf885"
},
{
"introduced": "dd8f7185faeca6ee968a6e9367f6d8601a83b8db"
},
{
"fixed": "a79efed95797b196575a98845dc989e3106a9acb"
},
{
"introduced": "1cdd190a25e483b65f1f25bbd0f13a25d696b461"
},
{
"fixed": "1db4b89687cc18311fc3f92623136705df24e671"
},
{
"fixed": "19dbab51ca086a657bb86458042bc44314916bcb"
},
{
"fixed": "ebd6be18120d1136511eb516338e27af25ac0a1a"
},
{
"fixed": "ee2c59e730e5b8faed502cd2c573109df093f856"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.2.3.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.4.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.2.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "19dbab51ca086a657bb86458042bc44314916bcb"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ebd6be18120d1136511eb516338e27af25ac0a1a"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ee2c59e730e5b8faed502cd2c573109df093f856"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ba76fca032a66f3716ca8a661c9ddb006acaf885"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v7.2.3.1"
},
{
"range": [
{
"fixed": "a79efed95797b196575a98845dc989e3106a9acb"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.0.4.1"
},
{
"range": [
{
"fixed": "1db4b89687cc18311fc3f92623136705df24e671"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.1.2.1"
}
]
}
}
],
"versions": [
"v7.2.3",
"v8.0.4",
"v8.1.2",
"v8.1.1",
"v8.1.0",
"v8.0.3",
"v8.0.2",
"v8.0.1",
"v8.0.0",
"v7.2.2",
"v7.2.1",
"v7.2.0.rc1",
"v7.2.0.beta3",
"v7.2.0.beta2",
"v7.2.0.beta1",
"v7.1.0.beta1",
"v7.0.0.alpha2",
"v7.0.0.alpha1",
"v6.1.0.rc1",
"v6.0.0.beta2",
"v6.0.0.beta1",
"v5.1.0.beta1",
"v5.0.0.beta4",
"v5.0.0.beta2",
"v5.0.0.beta1",
"v4.2.0.beta1",
"v4.0.0.rc1",
"v4.0.0.beta1",
"v3.2.0.rc1",
"v3.1.0.rc1",
"v3.1.0.beta1",
"v3.0.0.beta3",
"v3.0.0.beta.3",
"v2.0.1",
"v2.0.0",
"v2.0.0_RC2",
"v2.0.0_RC1",
"v2.0.0_PR",
"v1.1.1",
"v1.1.0",
"v1.1.0_RC1",
"v0.14.3",
"v0.14.1",
"v0.13.1",
"v0.13.0",
"v0.12.0",
"v0.11.1",
"v0.11.0",
"v0.10.1",
"v0.10.0",
"v0.9.5",
"v0.9.4.1",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33176.json"
}
}
],
"modified": "2026-10-28T02:30:46.855395785Z",
"provider": "osv",
"references": [
"https://github.com/rails/rails/releases/tag/v7.2.3.1",
"https://github.com/rails/rails/releases/tag/v8.0.4.1",
"https://github.com/rails/rails/releases/tag/v8.1.2.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33176.json",
"https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9",
"https://nvd.nist.gov/vuln/detail/CVE-2026-33176",
"https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb",
"https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a",
"https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856"
],
"provider_metadata": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33176.json"
}
},
"related_cves": [
{
"value": "CVE-2026-33176",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 515053,
"published_at": "2026-03-23T23:29:27.933+00:00"
}