| Package | Affected versions | Patched versions |
|---|---|---|
| activestorage | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
| rails | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.
The fixed releases are available at the normal locations.
This issue was responsibly reported by Hackerone researcher thwin_htet.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free