Bug 2456881 - CVE-2026-33174 rubygem-activestorage: Rails Active Storage: Denial of Service via unbounded Range header [fedora-all]
Summary: CVE-2026-33174 rubygem-activestorage: Rails Active Storage: Denial of Service...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: rubygem-activestorage
Version: 44
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Vít Ondruch
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["f260931f-fccd-442a-9eee-f...
Depends On:
Blocks: CVE-2026-33174
TreeView+ depends on / blocked
 
Reported: 2026-04-09 11:57 UTC by Avinash Hanwate
Modified: 2026-08-05 15:33 UTC (History)
2 users (show)

Fixed In Version: rubygem-activestorage-8.1.3.1-1.fc45
Clone Of:
Environment:
Last Closed: 2026-08-05 15:26:28 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2026-04-09 11:57:17 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Comment 1 Fedora Update System 2026-08-05 14:29:22 UTC 
FEDORA-2026-000149d00e (rubygem-actioncable-8.1.3.1-1.fc45, rubygem-actionmailbox-8.1.3.1-1.fc45, and 11 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-000149d00e
Comment 2 Fedora Update System 2026-08-05 15:26:28 UTC 
FEDORA-2026-000149d00e (rubygem-actioncable-8.1.3.1-1.fc45, rubygem-actionmailbox-8.1.3.1-1.fc45, and 11 more) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 3 Vít Ondruch 2026-08-05 15:33:11 UTC 
Re-opening. Addressed only in Rawhide. Still an issue for F44 and older
Note You need to log in before you can comment on or make changes to this bug.