{
  "cveId": "CVE-2026-33176",
  "url": "https://patchblox.com/security/cve/CVE-2026-33176",
  "summary": "CVE-2026-33176 is fixed in rails on 1 platform, first by DEBIAN-CVE-2026-33176, released March 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "rails: Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework",
  "description": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. \u00601e10000\u0060), which \u0060BigDecimal\u0060 expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.",
  "published": "2026-03-24T00:16:28Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00858,
  "epssPercentile": 0.58668,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2:6.1.7.10\u002Bdfsg-1~deb12u3",
      "fix": "DEBIAN-CVE-2026-33176",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33176",
      "released": "2026-03-24T00:16:28Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2:7.2.2.2\u002Bdfsg-2~deb13u2",
      "fix": "DEBIAN-CVE-2026-33176",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33176",
      "released": "2026-03-24T00:16:28Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 14",
      "fixedVersion": "2:7.2.3.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-33176",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33176",
      "released": "2026-03-24T00:16:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}