CVE-2026-33169

What it actually does

CVE-2026-33169 is a denial-of-service weakness in Active Support, the Ruby on Rails support library. The vulnerable NumberToDelimitedConverter implementation uses a repeated lookahead regular expression with gsub! to insert thousands delimiters into numeric strings. When processing very long digit strings, the regular-expression behavior can become quadratic, causing excessive CPU consumption and request-processing delays. The flaw is remotely triggerable when an application passes attacker-controlled or untrusted long numeric strings into affected number-formatting code such as Rails number delimiter helpers. It does not directly allow data theft, privilege escalation, or code execution, but it can reduce application availability.

Why it matters to the business

An attacker may be able to degrade or intermittently disrupt Rails-backed services by sending crafted requests containing unusually long numeric values that are later formatted by vulnerable Active Support code. The likely outcome is elevated CPU usage, slow responses, worker exhaustion, failed requests, autoscaling cost increases, and potential partial outage of affected application functions. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV or known ransomware use, but internet-facing Rails applications that format user-supplied numeric input should still prioritize remediation because exploitation requires no authentication or user interaction if a reachable endpoint exercises the vulnerable code path.

How an attack unfolds

An attacker first identifies a Rails application endpoint that accepts numeric-looking input and later formats that value with Active Support delimiter functionality. Examples may include reporting, search, pricing, billing, analytics, import, or API endpoints that normalize or display large numbers. The attacker then submits a request containing an extremely long sequence of digits. When the application passes that string into the vulnerable NumberToDelimitedConverter path, the lookahead-based regular expression repeatedly evaluates portions of the input while gsub! performs substitutions, producing disproportionately high CPU cost as input length grows. By repeating these requests or sending them concurrently, the attacker can tie up application workers, increase latency, trigger timeouts, and reduce availability for legitimate users.

How to fix it

Upgrade Active Support/Rails to a patched release. The patched versions identified for this issue are Active Support/Rails 8.1.2.1, 8.0.4.1, and 7.2.3.1. Applications using affected Rails branches should update the rails and activesupport gems to the appropriate fixed version for their branch, then rebuild, redeploy, and restart application processes. If immediate upgrade is not possible, apply compensating controls: enforce strict maximum length limits for numeric request parameters before formatting, reject unreasonably long digit strings at the controller/API boundary, add request body and parameter size limits at the application and reverse-proxy layers, and ensure request timeouts and worker limits are configured to prevent a small number of expensive requests from monopolizing capacity. Avoid passing raw untrusted strings into number delimiter helpers without validation and length constraints.

How to confirm the fix worked

Confirm that dependency resolution uses a patched Active Support version: 8.1.2.1, 8.0.4.1, 7.2.3.1, or later applicable patched release. Check Gemfile.lock, package inventory, container images, and deployed runtime versions for activesupport and rails. Run application tests that exercise number delimiter formatting with normal inputs to verify functional compatibility. For exposure validation, review code for use of ActiveSupport::NumberHelper, number_to_delimited, or related number-formatting helpers on user-controlled values. Safely test non-production environments with long digit strings to confirm requests are rejected quickly by validation or handled without abnormal CPU spikes. In production, verify that input length limits, request size limits, timeouts, and monitoring alerts are in place.

Typical attack path

1. Identify a Rails or Active Support-based application endpoint that accepts numeric input from a request body, query parameter, form field, uploaded data, or API payload.
2. Determine whether the endpoint formats numbers using Active Support/Rails delimiter helpers, directly or indirectly.
3. Send a crafted request containing an unusually long digit-only string or very large numeric-looking value.
4. Cause the vulnerable NumberToDelimitedConverter regular expression and gsub! interaction to consume excessive CPU time.
5. Repeat the request or run concurrent requests to exhaust application workers or CPU capacity.
6. Observe degraded response times, request timeouts, increased error rates, or service unavailability.

How to detect it

To determine whether exploitation was attempted or successful, review application access logs, API gateway logs, reverse-proxy logs, Rails production logs, APM traces, WAF events, and infrastructure CPU metrics. Look for requests with query strings, JSON fields, form fields, or uploaded content containing unusually long digit-only values, especially when followed by elevated response times, 408/499/500/502/503/504 errors, application worker timeouts, or CPU saturation. Correlate suspicious requests with endpoints known to call ActiveSupport::NumberHelper, number_to_delimited, or number formatting in views, serializers, reports, exports, or API responses. In Rails logs and APM data, investigate slow transactions where stack traces, spans, or method names reference ActiveSupport::NumberHelper::NumberToDelimitedConverter or number_to_delimited. Also look for repeated requests from the same source IPs, user agents, API clients, or autonomous systems that submit very large numeric parameters and cause disproportionate processing time. There are no known malware artifacts or fixed network indicators for this vulnerability; detection should focus on behavioral evidence of long numeric payloads causing CPU-bound slow requests.

• ActiveSupport::NumberHelper::NumberToDelimitedConverter
• number_to_delimited
• NumberToDelimitedConverter
• ActiveSupport::NumberHelper
• ActionController::Live::ClientDisconnected
• Rack::Timeout::RequestTimeoutException
• Net::ReadTimeout
• execution expired
• Request ran for longer than
• Completed 500
• Completed 503
• Completed 504
• Started GET
• Started POST

What your security team should do

• Inventory Rails applications and services that include vulnerable activesupport or rails versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1.
• Prioritize internet-facing applications and APIs that accept numeric parameters, file imports, report filters, analytics inputs, billing values, or other user-controlled data likely to be formatted as numbers.
• Upgrade affected applications to the patched Rails/Active Support release for their branch and redeploy all runtime artifacts, including containers and serverless packages.
• Add or verify maximum length validation for numeric inputs before any formatting or conversion logic is invoked.
• Configure reverse proxies, application servers, and frameworks with conservative request body limits, header/query limits, request timeouts, and worker recycling where appropriate.
• Add monitoring for sudden increases in CPU usage, request latency, timeout errors, and repeated requests containing unusually long digit sequences.
• Review logs from the period since publication on 2026-03-24 for signs of probing or repeated long numeric payloads against endpoints that perform number formatting.
• Because exploit maturity is currently reported as none and EPSS is low, treat this as a focused availability-risk patching item rather than an emergency response unless exposed code paths or active anomalies are identified.