Ruby on Rails Active Storage DoS Vulnerability (CVE-2026-33174)
A denial-of-service vulnerability (CVE-2026-33174) exists in Ruby on Rails Active Storage versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1 due to unbounded memory allocation when handling large or unbounded Range headers in proxy delivery mode.
CVE-2026-33174 is a denial-of-service vulnerability affecting Ruby on Rails applications that utilize Active Storage. Specifically, it impacts versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1. The vulnerability stems from the way Active Storage handles file serving through its proxy delivery mode. When processing requests with large or unbounded Range headers (e.g., bytes=0-), the proxy controller incorrectly loads the entire requested byte range into memory before sending it to the client…
Detection coverage 2
Detect Suspicious Range Header
mediumDetects HTTP requests with unusually large Range headers, potentially indicating a DoS attack attempt against Rails Active Storage.
Detect Multiple Large Range Header Requests
highDetects multiple requests with large Range headers from the same IP address within a short time period, potentially indicating a DoS attack.
Detection queries are kept inside the platform. Get full rules →