Skip to content
fr Sign in
6.9 Medium

CVE-2026-33169 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework

Description

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected products and versions

Product Affected versions Fixed in
ActiveSupport 8.1 8.1.0.beta1 → < 8.1.2.1 8.1.2.1
ActiveSupport 8.0 8.0.0.beta1 → < 8.0.4.1 8.0.4.1
ActiveSupport 7.2 earliest → < 7.2.3.1 7.2.3.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of ActiveSupport

The 5 CVEs of ActiveSupport →
CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework 6.6 Medium CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework 5.3 Medium CVE-2023-28120 There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user… 5.3 Medium CVE-2023-38037 ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file 5.5 Medium
Track this CVE