Most recent entries from all

bdu:2026-07235

certfr-2026-avi-0349 — De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à u…

certfr-2026-avi-0349

EUVD-2026-277106

fkie_cve-2026-33174

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

GHSA-r46p-8f7g-vvvg — Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Affected: RubyGems: activestorage

### Impact When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone user [pirikara](https://hackerone.com/pirikara)

UBUNTU-CVE-2026-33174

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

WID-SEC-W-2026-0833 — Ruby on Rails: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.