CVE-2026-33169
Published: Mar 23, 2026
Modified: Mar 24, 2026
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
| Vendor | Product | Versions |
|---|---|---|
rails | activesupport | affected >= 8.1.0.beta1, < 8.1.2.1affected >= 8.0.0.beta1, < 8.0.4.1affected < 7.2.3.1 |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now