{
  "cveId": "CVE-2026-33169",
  "url": "https://patchblox.com/security/cve/CVE-2026-33169",
  "summary": "CVE-2026-33169 is fixed in rails on 1 platform, first by DEBIAN-CVE-2026-33169, released March 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rails: Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework",
  "description": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. \u0060NumberToDelimitedConverter\u0060 uses a lookahead-based regular expression with \u0060gsub!\u0060 to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and \u0060gsub!\u0060 can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.",
  "published": "2026-03-24T00:16:28Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "epss": 0.00656,
  "epssPercentile": 0.51658,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2:6.1.7.10\u002Bdfsg-1~deb12u3",
      "fix": "DEBIAN-CVE-2026-33169",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33169",
      "released": "2026-03-24T00:16:28Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2:7.2.2.2\u002Bdfsg-2~deb13u2",
      "fix": "DEBIAN-CVE-2026-33169",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33169",
      "released": "2026-03-24T00:16:28Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 14",
      "fixedVersion": "2:7.2.3.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-33169",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33169",
      "released": "2026-03-24T00:16:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}