| Package | Affected versions | Patched versions |
|---|---|---|
| activestorage | ≥ 8.0.0.beta1, < 8.0.4.1≥ 8.1.0.beta1, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
| rails | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
When serving files through Active Storage's Blobs::ProxyController, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. bytes=0-) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.
The fixed releases are available at the normal locations.
This issue was responsibly reported by Hackerone user pirikara
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free