CVE-2026-33658

What it actually does

This is a network-reachable denial-of-service weakness in the Rails Active Storage proxy controller. Vulnerable versions do not cap the number of byte ranges accepted in an HTTP Range header when proxying stored files. An authenticated or otherwise authorized requester who can access an Active Storage proxied file can send a single request containing thousands of small byte ranges. The server must parse, validate, and generate multipart range responses for each range, causing CPU consumption that is disproportionately high compared with serving the same file normally. Repeated requests can exhaust application worker capacity and degrade or interrupt file-serving and broader Rails application availability. Confidentiality and integrity are not directly impacted.

Why it matters to the business

Applications that use Rails Active Storage proxy delivery may become slow or unavailable if attackers or abusive users send crafted file requests. This can disrupt user-facing file downloads, image/media delivery, document access, and any workflows that depend on attachment retrieval. Because exploitation is low complexity over the network but generally requires access to a valid proxied Active Storage URL or authenticated application functionality, the main risk is service degradation rather than data theft. The vulnerability is not listed in CISA KEV and has low EPSS at the time of assessment, but internet-exposed Rails applications with widely accessible attachments should still prioritize patching because denial-of-service attacks can be inexpensive to automate.

How an attack unfolds

An attacker first identifies a Rails application using Active Storage proxy endpoints or obtains access to functionality that returns proxied Active Storage URLs. They then choose a valid blob or representation URL and send HTTP requests with a Range header containing a very large number of tiny byte ranges, such as many one-byte or overlapping ranges. The vulnerable Active Storage proxy controller attempts to process all requested ranges and construct an appropriate partial-content response. Processing thousands of ranges consumes excessive CPU and ties up application workers. By repeating these requests concurrently, the attacker can reduce throughput, cause elevated latency, trigger request timeouts, and potentially make the application unavailable to legitimate users.

How to fix it

Upgrade Rails to a patched version that limits excessive byte ranges in Active Storage proxy handling: Rails 8.1.2.1 or later, Rails 8.0.4.1 or later, or Rails 7.2.3.1 or later. If immediate upgrade is not possible, mitigate at the reverse proxy, CDN, WAF, or load balancer by rejecting or normalizing requests to Active Storage proxy paths that contain an excessive number of comma-separated ranges in the HTTP Range header. Consider disabling proxy mode for untrusted traffic where feasible, using redirect-based Active Storage delivery, placing file delivery behind a CDN that enforces sane range handling, and applying rate limits to attachment download endpoints. Monitor CPU saturation and application worker exhaustion while the mitigation is being deployed.

How to confirm the fix worked

Confirm the running Rails version is one of the patched releases: 8.1.2.1 or later, 8.0.4.1 or later, or 7.2.3.1 or later. Review dependency lockfiles and deployed runtime versions, not only source manifests, to verify the patched Action Pack/Active Storage code is actually in production. Test a staging environment by sending a request to an Active Storage proxy URL with an intentionally excessive multi-range header and confirm it is rejected, capped, normalized, or handled without disproportionate CPU usage. Validate any WAF/CDN/reverse-proxy rule by confirming requests with many comma-separated byte ranges are blocked or reduced before reaching Rails. Check application metrics for reduced CPU spikes, fewer long-running Active Storage proxy requests, and stable worker utilization after remediation.

Typical attack path

1. Identify a Rails application that serves attachments through Active Storage proxy endpoints.
2. Obtain or generate a valid URL for an Active Storage blob or representation that the requester is allowed to access.
3. Send an HTTP GET request to the proxied file URL with a Range header containing thousands of small byte ranges.
4. Cause the Rails application to spend excessive CPU parsing and responding to the multi-range request.
5. Repeat the crafted requests concurrently to exhaust application worker capacity and degrade or deny service.

How to detect it

Look for evidence of abnormal requests to Rails Active Storage proxy endpoints containing very large HTTP Range headers or many comma-separated byte ranges. Useful sources include web server access logs, CDN/WAF logs, reverse-proxy logs, application request logs, APM traces, Rails logs, load balancer logs, and host metrics for application worker CPU usage. Focus on repeated GET requests to Active Storage proxy blob or representation paths, especially responses with HTTP 206 Partial Content, 416 Range Not Satisfiable, 400 Bad Request, 499/502/503/504 errors, long request durations, or spikes in CPU utilization from Rails application server processes. If Range headers are not logged, use WAF/CDN telemetry or packet capture from a controlled period to determine whether requests contained thousands of ranges. Correlate suspicious requests by source IP, authenticated user/session, user agent, requested blob path, response status, request duration, and concurrent worker saturation. Because this is a denial-of-service issue, exploitation evidence is more likely to appear as traffic and performance anomalies than persistent files or malware artifacts.

• Range: bytes=
• /rails/active_storage/blobs/proxy/
• /rails/active_storage/representations/proxy/
• GET /rails/active_storage/blobs/proxy/
• GET /rails/active_storage/representations/proxy/
• 206
• 416
• ActionController::BadRequest
• Range Not Satisfiable
• Puma
• unicorn
• passenger

What your security team should do

• Inventory Rails applications that use Active Storage proxy delivery and identify versions below 8.1.2.1, 8.0.4.1, or 7.2.3.1.
• Prioritize patching internet-facing or customer-facing Rails applications that expose Active Storage attachment URLs.
• Add temporary WAF, CDN, or reverse-proxy controls to block HTTP Range headers with an excessive number of comma-separated byte ranges on Active Storage proxy paths.
• Enable or enhance logging of request headers for suspicious Active Storage traffic, especially the Range header, where privacy and performance constraints allow.
• Create detections for repeated requests to Active Storage proxy endpoints with multi-range headers, high 206 response volumes, request timeouts, and CPU spikes from application worker processes.
• Rate-limit attachment download endpoints and authenticated users or IP addresses generating abnormal Active Storage request volumes.
• After upgrading, run controlled validation tests to ensure excessive range requests no longer cause elevated CPU usage.