Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions     8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy     controller loads the entire requested byte range into memory before sending it. A request with a large or     unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the     file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1,     and 7.2.3.1 contain a patch. (CVE-2026-33174)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions
    8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy
    controller loads the entire requested byte range into memory before sending it. A request with a large or
    unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the
    file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1,
    and 7.2.3.1 contain a patch. (CVE-2026-33174)

ID	Name	Product	Family	Severity
303640	Linux Distros Unpatched Vulnerability : CVE-2026-33174	Nessus	Misc.	high
439114	SCA: security update for activestorage (GHSA-r46p-8f7g-vvvg)	Tenable Cloud Security	SCA Checks	high
439114	SCA: security update for activestorage (GHSA-r46p-8f7g-vvvg)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-33174

high

Tenable Plugins

high

high

high