Answer in brief
CVE-2026-33658 records a Medium severity (CVSS 6.5) vulnerability in Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests. The current sources do not mark it as known exploited. The current feed maps activestorage (rubygems), activestorage (rubygems), activestorage (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps activestorage (rubygems), activestorage (rubygems), activestorage (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| activestoragerubygems | >=8.1.0 <8.1.2.1 | 8.1.2.1 |
| activestoragerubygems | >=8.0.0 <8.0.4.1 | 8.0.4.1 |
| activestoragerubygems | >=0 <7.2.3.1 | 7.2.3.1 |
Published upstream
Mar 25, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
### Impact Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. ### Releases The fixed releases are available at the normal locations. ### Credit This issue was responsibly reported by Hackerone researcher [thwin_htet](https://hackerone.com/thwin_htet).
Quoted source text, attributed separately from HOL analysis.