{"id":"CVE-2026-126085","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-126085","summary":"Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage","details":"### Impact\n`ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the declared content length into the signed direct-upload URL, and `#headers_for_direct_upload` returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the `byte_size` it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service.\n\nApplications that store files in Google Cloud Storage and accept direct uploads are affected.\n\n### Details\nThe fixed releases sign an `x-goog-content-length-range` header that matches the blob's declared `byte_size` and return it from `headers_for_direct_upload`, so Cloud Storage rejects an upload body of any other size. Browsers send this header with the direct upload, so a bucket's CORS configuration must list `x-goog-content-length-range` in `responseHeader`, or browser direct uploads fail after the upgrade. The Active Storage CHANGELOG and the CORS example in the Active Storage guide show the change.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7.patch\n- 8.0: https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [f4cts](https://hackerone.com/f4cts).","published":"2026-11-10T21:37:19Z","modified":"2026-11-10T21:45:04.240426616Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"activestorage","fixedVersion":"8.1.4.1"},{"ecosystem":"RubyGems","name":"activestorage","fixedVersion":"8.0.5.2"}],"fix":{"url":"https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c","label":"rails/rails@7fe85a7"},"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2"},{"type":"WEB","url":"https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c"},{"type":"WEB","url":"https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-10T21:45:04.240426616Z"}}