https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:06:57.692489+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07235 bdu:2026-07235 2026-10-03T08:06:57.774847+00:00 bdu:2026-07235 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 certfr-2026-avi-0349 — De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à u… 2026-10-03T08:06:57.774886+00:00 certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/euvd-2026-277106 EUVD-2026-277106 2026-10-03T08:06:57.774906+00:00 EUVD-2026-277106 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33174 fkie_cve-2026-33174 2026-10-03T08:06:57.774919+00:00

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

 https://cve.radiocsirt.org/vuln/ghsa-r46p-8f7g-vvvg GHSA-r46p-8f7g-vvvg — Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests 2026-10-03T08:06:57.774949+00:00

Affected: RubyGems: activestorage

### Impact When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone user [pirikara](https://hackerone.com/pirikara)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33174 UBUNTU-CVE-2026-33174 2026-10-03T08:06:57.774978+00:00

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833 WID-SEC-W-2026-0833 — Ruby on Rails: Mehrere Schwachstellen 2026-10-03T08:06:57.775008+00:00

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.