Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

GHSA-cg4j-q9v8-6v38 · CVE-2026-33169

Published Mar 23, 2026 · Modified May 13, 2026

Description

Impact

NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher scyoon.

References

WEB https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-33169
WEB https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
WEB https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
WEB https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
PACKAGE https://github.com/rails/rails
WEB https://github.com/rails/rails/releases/tag/v7.2.3.1
WEB https://github.com/rails/rails/releases/tag/v8.0.4.1
WEB https://github.com/rails/rails/releases/tag/v8.1.2.1
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33169.yml

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes