Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails     framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert     thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the     repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions     8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. (CVE-2026-33169)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails
    framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert
    thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the
    repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions
    8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. (CVE-2026-33169)

ID	Name	Product	Family	Severity
305990	Photon OS 4.0: Rubygem PHSA-2026-4.0-0995	Nessus	PhotonOS Local Security Checks	high
305120	Photon OS 5.0: Rubygem PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	high
303652	Linux Distros Unpatched Vulnerability : CVE-2026-33169	Nessus	Misc.	medium
439124	SCA: security update for activesupport (GHSA-cg4j-q9v8-6v38)	Tenable Cloud Security	SCA Checks	medium
439124	SCA: security update for activesupport (GHSA-cg4j-q9v8-6v38)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33169

medium

Tenable Plugins

high

high

medium

medium

medium