CVE-2026-33169

MEDIUM6.9

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Published Mar 23, 2026

Modified 1 months ago

Details

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

References

WEB

https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11

WEB

https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974

WEB

https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49

WEB

https://github.com/rails/rails/releases/tag/v7.2.3.1

WEB

https://github.com/rails/rails/releases/tag/v8.0.4.1

WEB