CVE-2026-33169 — activesupport
Fix: rails/rails@29154f1CVE-2026-33169 is a Uncontrolled Resource Consumption vulnerability in activesupport. A fix is available for activesupport — see the affected versions and patch details below.
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-33169.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
activesupport💎activesupport💎activesupportReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | activesupport | ≥ 8.1.0.beta1&&< 8.1.2.1 | 8.1.2.1bundle update activesupport --conservative |
| 💎RubyGems | activesupport | ≥ 8.0.0.beta1&&< 8.0.4.1 | 8.0.4.1bundle update activesupport --conservative |
| 💎RubyGems | activesupport | all versions | 7.2.3.1bundle update activesupport --conservative |
Affected Products
railsrubyonrailsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for activesupport, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update activesupport to 8.1.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-33169 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This Moderate severity denial of service flaw in Active Support's NumberToDelimitedConverter causes excessive resource consumption when processing specially crafted long digit strings. Applications like Red Hat Satellite are susceptible to service disruption if they explicitly pass unvalidated, user-controlled input…
Restrict Satellite HTTPS (443) to trusted admin and Capsule networks. Cap HTTP request and parameter size at Apache so oversized digit strings cannot reach Foreman. Rate-limit the Satellite UI/API and set CPU limits on Foreman workers.Source: Red Hat security advisory for CVE-2026-33169 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-33169 in your dependencies?
Find it across RubyGems, including transitive dependencies.