CVE-2026-33169 PUBLISHED

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

• https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
• https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
• https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
• https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
• https://github.com/rails/rails/releases/tag/v7.2.3.1
• https://github.com/rails/rails/releases/tag/v8.0.4.1
• https://github.com/rails/rails/releases/tag/v8.1.2.1

• CWE-400: Uncontrolled Resource Consumption CWE
• CWE-1333: Inefficient Regular Expression Complexity CWE