CVE-2026-33176

What it actually does

CVE-2026-33176 is a denial-of-service flaw in Ruby on Rails Active Support number formatting helpers. Vulnerable versions before 8.1.2.1, 8.0.4.1, and 7.2.3.1 accept numeric strings in scientific notation, such as `1e10000`, and pass them into `BigDecimal`. When the value is formatted, `BigDecimal` can expand the number into an extremely large decimal representation, causing excessive CPU use and memory allocation. In applications where attacker-controlled input reaches Active Support number helpers, a remote unauthenticated attacker may be able to degrade or crash application worker processes without needing code execution or authentication.

Why it matters to the business

Successful exploitation can make affected Rails applications slow, unstable, or unavailable by exhausting application server resources. Public-facing features that format user-supplied numbers, prices, quantities, metrics, percentages, or financial values are the highest-risk exposure points. The CVSS availability impact is high, but the current EPSS score is low and the issue is not listed in CISA KEV, so organizations should prioritize based on whether internet-exposed applications pass request parameters into Rails number helpers.

How an attack unfolds

An attacker identifies an application endpoint that accepts a numeric value and later formats it using Active Support number helpers, such as currency, percentage, delimited number, precision, or human-readable formatting helpers. The attacker submits a crafted scientific-notation string with a very large exponent, for example `1e10000` or larger. In vulnerable Active Support versions, the helper accepts the string and `BigDecimal` expands it during formatting. This expansion consumes disproportionate memory and CPU. Repeated requests, or a small number of requests with very large exponents, can tie up Rails workers, trigger garbage collection pressure, cause process termination by the operating system or container runtime, and produce application-level downtime. No public exploit maturity or known KEV exploitation is currently indicated, but the exploit pattern is simple once an exposed formatting path is found.

How to fix it

Upgrade Active Support/Rails to a patched version: 8.1.2.1 or later for the 8.1 branch, 8.0.4.1 or later for the 8.0 branch, or 7.2.3.1 or later for the 7.2 branch. If immediate upgrade is not possible, add strict server-side validation before any number formatting path: reject scientific notation where not explicitly required, limit numeric string length, cap exponent size, coerce only bounded numeric values, and return validation errors before invoking Rails number helpers. Apply request body and query length limits at the web server or application gateway, and use rate limiting for endpoints that perform numeric formatting. Ensure process managers, container memory limits, and autoscaling policies are configured to recover from worker exhaustion, but treat those as compensating controls rather than a fix.

How to confirm the fix worked

Confirm the installed Active Support version by reviewing `Gemfile.lock`, dependency manifests, software composition analysis output, or runtime gem inventory. The application is remediated when `activesupport` is at 8.1.2.1, 8.0.4.1, 7.2.3.1, or a later fixed release on the relevant branch. Identify routes/controllers/views/serializers that call Rails number helpers with request-derived values and verify they reject oversized scientific-notation inputs before formatting. In a non-production test environment, send bounded test payloads such as `1e10000` to suspected endpoints and confirm the application returns a validation error without abnormal CPU, memory growth, long response times, worker restarts, or 5xx errors. Re-run dependency scanning after deployment to verify vulnerable versions are no longer present in packaged images, build artifacts, and deployed application instances.

Typical attack path

1. Find a Rails application endpoint that accepts numeric input, such as amount, price, total, quantity, percentage, rate, size, or metric values.
2. Determine whether the application reflects or renders that input through Active Support number formatting helpers.
3. Submit a scientific-notation payload with an extremely large exponent, such as `1e10000`.
4. Cause the vulnerable helper to invoke `BigDecimal` and expand the value into a massive decimal representation.
5. Consume excessive CPU and memory in one or more Rails worker processes.
6. Repeat requests or increase exponent size to amplify worker exhaustion, 5xx errors, restarts, or service unavailability.

How to detect it

To determine whether exploitation has already occurred, review HTTP access logs, load balancer logs, WAF logs, Rails application logs, APM traces, process manager logs, container runtime events, and operating system memory logs. Search for request parameters or JSON fields containing scientific notation with unusually large positive exponents, especially values similar to `1e10000`, `1E10000`, or larger. Correlate those requests with elevated response times, HTTP 500/502/503/504 responses, Rails worker timeouts, Puma/Unicorn/Passenger restarts, container OOMKilled events, Linux OOM killer messages, memory spikes, high garbage collection activity, and sudden drops in available workers. Focus on endpoints that handle prices, amounts, totals, percentages, quantities, measurements, or reporting data. Absence of a unique file artifact is expected because this is a resource-exhaustion issue rather than code execution; detection is primarily behavioral and log-based.

• 1e10000
• 1E10000
• 1e100000
• 1E100000
• e10000
• E10000
• BigDecimal
• ActiveSupport::NumberHelper
• ActionView::Helpers::NumberHelper
• number_to_currency
• number_to_percentage
• number_to_human
• number_with_precision
• number_with_delimiter
• Out of memory: Killed process
• oom-kill
• OOMKilled
• worker timeout
• PumaWorkerKiller
• unicorn worker timeout

What your security team should do

• Inventory Rails applications and identify those using vulnerable `activesupport` versions before 8.1.2.1, 8.0.4.1, or 7.2.3.1.
• Prioritize internet-facing applications and APIs that accept user-supplied numeric values and render formatted numbers, currency, percentages, or metrics.
• Upgrade Active Support/Rails to the appropriate patched version and rebuild/redeploy all affected application images or packages.
• Add input validation to reject scientific notation or excessive numeric length where business logic does not require it.
• Implement or tune rate limits, request-size limits, worker memory limits, and circuit breakers for endpoints that format numeric input.
• Search recent access logs, application logs, APM traces, and container/system logs for large-exponent scientific-notation inputs correlated with latency spikes, 5xx responses, OOM kills, or application worker restarts.
• Add SIEM detections for numeric request parameters containing scientific notation with unusually large exponents.
• Because the issue is not currently KEV-listed and has low EPSS, use exposure-based prioritization, but do not defer patching for public applications with likely user-controlled number formatting.