Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-000149d00e advisory.

    Update Ruby on Rails 8.1.3.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions     8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy     controller loads the entire requested byte range into memory before sending it. A request with a large or     unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the     file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1,     and 7.2.3.1 contain a patch. (CVE-2026-33174)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions
    8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy
    controller loads the entire requested byte range into memory before sending it. A request with a large or
    unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the
    file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1,
    and 7.2.3.1 contain a patch. (CVE-2026-33174)

ID	Name	Product	Family	Type	Severity
332765	Fedora 45 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2026-000149d00e)	Nessus	Fedora Local Security Checks	Local	high
303640	Linux Distros Unpatched Vulnerability : CVE-2026-33174	Nessus	Misc.	Local	high
439114	SCA: security update for activestorage (GHSA-r46p-8f7g-vvvg)	Tenable Cloud Security	SCA Checks	Local	high
439114	SCA: security update for activestorage (GHSA-r46p-8f7g-vvvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-33174

high

Tenable Plugins

high

high

high

high