Aller au contenu
en Se connecter
6.6 Moyenne

CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework

Description

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Produits et versions touchés

Produit Versions touchées Corrigé en
ActiveSupport 8.1 8.1.0.beta1 → < 8.1.2.1 8.1.2.1
ActiveSupport 8.0 8.0.0.beta1 → < 8.0.4.1 8.0.4.1
ActiveSupport 7.2 premières → < 7.2.3.1 7.2.3.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de ActiveSupport

Les 5 CVE de ActiveSupport →
CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework 5.3 Moyenne CVE-2026-33169 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework 6.9 Moyenne CVE-2023-28120 There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user… 5.3 Moyenne CVE-2023-38037 ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file 5.5 Moyenne
Suivre cette CVE