Incorrect Regular Expression in Ruby on Rails - CVE-2026-33169
Published: March 24, 2026
Vulnerability identifier: #VU124271
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-33169
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions within number_to_delimited in Active Support. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
Ruby on Rails
Debian Linux
rails (Debian package)
Debian Linux
rails (Debian package)
How to mitigate CVE-2026-33169
Install updates from vendor's website.
Ruby on Rails - addressed in versions 7.2.3.1, 8.0.4.1, 8.1.2.1
rails (Debian package) - update to 2:7.2.2.2+dfsg-2~deb13u2
rails (Debian package) - update to 2:7.2.2.2+dfsg-2~deb13u2