Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

The core of this vulnerability lies in the Active Storage proxy controller's lack of limitations on the number of byte ranges accepted in an HTTP Range header. Normally, requesting a file involves a single request. However, an attacker can send a request containing thousands of small byte range requests for the same file. The server must process each range individually, leading to a significant increase in CPU load compared to a standard request. This excessive CPU usage can degrade performance, potentially leading to service unavailability and a denial of service for legitimate users. The impact is primarily focused on resource exhaustion on the server hosting the Active Storage proxy.

Applications using Ruby on Rails Active Storage versions 8.1.2 and earlier are at risk. This includes web applications that heavily rely on file uploads and serving through Active Storage, particularly those with publicly accessible file storage. Shared hosting environments utilizing older Ruby on Rails versions are also particularly vulnerable.

• ruby / server:

ps aux | grep 'ActiveStorage::ProxyController' | grep -c 'byte range'

• ruby / server:

journalctl -u puma -g 'ActiveStorage::ProxyController' | grep 'byte range'

• generic web:

curl -I <active_storage_url> | grep 'Range:'

1. 2026-03-25Disclosure

   disclosure

2. 2026-03-25Patch

   patch

1. आरक्षित2026-03-23
2. प्रकाशित2026-03-25
3. संशोधित2026-03-30
4. EPSS अद्यतन2026-04-03

The primary mitigation for CVE-2026-33658 is to upgrade to Ruby on Rails version 8.1.2.1 or later, which includes a fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing rate limiting on the Active Storage proxy controller to restrict the number of byte range requests from a single IP address within a given timeframe. Web application firewalls (WAFs) can also be configured to detect and block requests with an unusually high number of byte range headers. Monitor CPU usage on the server hosting Active Storage to detect potential DoS attacks.