Expired pointer dereference in Ruby on Rails - CVE-2026-33173
Published: March 24, 2026
Vulnerability identifier: #VU124273
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33173
CWE-ID: CWE-825
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. A remote attacker can gain access to sensitive information on the target system.
Affected software
Ruby on Rails
Debian Linux
rails (Debian package)
Debian Linux
rails (Debian package)
How to mitigate CVE-2026-33173
Install updates from vendor's website.
Ruby on Rails - addressed in versions 7.2.3.1, 8.0.4.1, 8.1.2.1
rails (Debian package) - update to 2:7.2.2.2+dfsg-2~deb13u2
rails (Debian package) - update to 2:7.2.2.2+dfsg-2~deb13u2