6.6
Medium
CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ActiveSupport 8.1 | 8.1.0.beta1 → < 8.1.2.1 | 8.1.2.1 |
| ActiveSupport 8.0 | 8.0.0.beta1 → < 8.0.4.1 | 8.0.4.1 |
| ActiveSupport 7.2 | earliest → < 7.2.3.1 | 7.2.3.1 |
Other CVEs of ActiveSupport
The 5 CVEs of ActiveSupport →
CVE-2026-33170
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework
5.3
Medium
CVE-2026-33169
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework
6.9
Medium
CVE-2023-28120
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user…
5.3
Medium
CVE-2023-38037
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file
5.5
Medium