Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions     8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges     in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage     compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions     8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. (CVE-2026-33658)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions
    8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges
    in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage
    compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions
    8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. (CVE-2026-33658)

ID	Name	Product	Family	Severity
304159	Linux Distros Unpatched Vulnerability : CVE-2026-33658	Nessus	Misc.	medium
439227	SCA: security update for activestorage (GHSA-p9fm-f462-ggrg)	Tenable Cloud Security	SCA Checks	medium
439227	SCA: security update for activestorage (GHSA-p9fm-f462-ggrg)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33658

medium

Tenable Plugins

medium

medium

medium