要点
- CVE-2026-33169 是影响 activesupport, rails (rubyonrails) 的中危 (CVSS 5.3)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.66%，高于 51.4% 的漏洞。
- 修复：升级到 8.0.4.1, 8.1.2.1, 7.2.3.1 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| activesupport RubyGems | ≥ 8.0.0.beta1, < 8.0.4.1≥ 8.1.0.beta1, < 8.1.2.1< 7.2.3.1
| 8.0.4.18.1.2.17.2.3.1
|
| rails | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1
| 8.0.4.18.1.2.17.2.3.1
|
Description
Impact
NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.
Releases
The fixed releases are available at the normal locations.
Credit
This issue was responsibly reported by Hackerone researcher scyoon.
NVD description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free