Ruby/activesupport/7.1.0.rc1
A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.
https://rubygems.org/gems/activesupport
MIT
3 Security Vulnerabilities
Rails Active Support has a possible DoS vulnerability in its number helpers
Published date: 2026-03-23T21:15:16Z
CVE: CVE-2026-33176
Links:
- https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
- https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
- https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
- https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://github.com/advisories/GHSA-2j26-frm8-cmj9
- https://nvd.nist.gov/vuln/detail/CVE-2026-33176
Impact
Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.
Releases
The fixed releases are available at the normal locations.
Affected versions: ["7.2.3", "7.2.2.2", "7.2.2.1", "7.2.2", "7.2.1.2", "7.2.1.1", "7.2.1", "7.2.0", "7.2.0.rc1", "7.2.0.beta3", "7.2.0.beta2", "7.2.0.beta1", "7.1.6", "7.1.5.2", "7.1.5.1", "7.1.5", "7.1.4.2", "7.1.4.1", "7.1.4", "7.1.3.4", "7.1.3.3", "7.1.3.2", "7.1.3.1", "7.1.3", "7.1.2", "7.1.1", "7.1.0", "7.1.0.rc2", "7.1.0.rc1", "7.1.0.beta1", "7.0.10", "7.0.9", "7.0.8.7", "7.0.8.6", "7.0.8.5", "7.0.8.4", "7.0.8.3", "7.0.8.2", "7.0.8.1", "7.0.8", "7.0.7.2", "7.0.7.1", "7.0.7", "7.0.6", "7.0.5.1", "7.0.5", "7.0.4.3", "7.0.4.2", "7.0.4.1", "7.0.4", "7.0.3.1", "7.0.3", "7.0.2.4", "7.0.2.3", "7.0.2.2", "7.0.2.1", "7.0.2", "7.0.1", "7.0.0", "7.0.0.rc3", "7.0.0.rc2", "7.0.0.rc1", "7.0.0.alpha2", "7.0.0.alpha1", "6.1.7.10", "6.1.7.9", "6.1.7.8", "6.1.7.7", "6.1.7.6", "6.1.7.5", "6.1.7.4", "6.1.7.3", "6.1.7.2", "6.1.7.1", "6.1.7", "6.1.6.1", "6.1.6", "6.1.5.1", "6.1.5", "6.1.4.7", "6.1.4.6", "6.1.4.5", "6.1.4.4", "6.1.4.3", "6.1.4.2", "6.1.4.1", "6.1.4", "6.1.3.2", "6.1.3.1", "6.1.3", "6.1.2.1", "6.1.2", "6.1.1", "6.1.0", "6.1.0.rc2", "6.1.0.rc1", "6.0.6.1", "6.0.6", "6.0.5.1", "6.0.5", "6.0.4.8", "6.0.4.7", "6.0.4.6", "6.0.4.5", "6.0.4.4", "6.0.4.3", "6.0.4.2", "6.0.4.1", "6.0.4", "6.0.3.7", "6.0.3.6", "6.0.3.5", "6.0.3.4", "6.0.3.3", "6.0.3.2", "6.0.3.1", "6.0.3", "6.0.3.rc1", "6.0.2.2", "6.0.2.1", "6.0.2", "6.0.2.rc2", "6.0.2.rc1", "6.0.1", "6.0.1.rc1", "6.0.0", "6.0.0.rc2", "6.0.0.rc1", "6.0.0.beta3", "6.0.0.beta2", "6.0.0.beta1", "5.2.8.1", "5.2.8", "5.2.7.1", "5.2.7", "5.2.6.3", "5.2.6.2", "5.2.6.1", "5.2.6", "5.2.5", "5.2.4.6", "5.2.4.5", "5.2.4.4", "5.2.4.3", "5.2.4.2", "5.2.4.1", "5.2.4", "5.2.4.rc1", "5.2.3", "5.2.3.rc1", "5.2.2.1", "5.2.2", "5.2.2.rc1", "5.2.1.1", "5.2.1", "5.2.1.rc1", "5.2.0", "5.2.0.rc2", "5.2.0.rc1", "5.2.0.beta2", "5.2.0.beta1", "5.1.7", "5.1.7.rc1", "5.1.6.2", "5.1.6.1", "5.1.6", "5.1.5", "5.1.5.rc1", "5.1.4", "5.1.4.rc1", "5.1.3", "5.1.3.rc3", "5.1.3.rc2", "5.1.3.rc1", "5.1.2", "5.1.2.rc1", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.1.0.beta1", "5.0.7.2", "5.0.7.1", "5.0.7", "5.0.6", "5.0.6.rc1", "5.0.5", "5.0.5.rc2", "5.0.5.rc1", "5.0.4", "5.0.4.rc1", "5.0.3", "5.0.2", "5.0.2.rc1", "5.0.1", "5.0.1.rc2", "5.0.1.rc1", "5.0.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "5.0.0.beta4", "5.0.0.beta3", "5.0.0.beta2", "5.0.0.beta1.1", "5.0.0.beta1", "5.0.0.racecar1", "4.2.11.3", "4.2.11.2", "4.2.11.1", "4.2.11", "4.2.10", "4.2.10.rc1", "4.2.9", "4.2.9.rc2", "4.2.9.rc1", "4.2.8", "4.2.8.rc1", "4.2.7.1", "4.2.7", "4.2.7.rc1", "4.2.6", "4.2.6.rc1", "4.2.5.2", "4.2.5.1", "4.2.5", "4.2.5.rc2", "4.2.5.rc1", "4.2.4", "4.2.4.rc1", "4.2.3", "4.2.3.rc1", "4.2.2", "4.2.1", "4.2.1.rc4", "4.2.1.rc3", "4.2.1.rc2", "4.2.1.rc1", "4.2.0", "4.2.0.rc3", "4.2.0.rc2", "4.2.0.rc1", "4.2.0.beta4", "4.2.0.beta3", "4.2.0.beta2", "4.2.0.beta1", "4.1.16", "4.1.16.rc1", "4.1.15", "4.1.15.rc1", "4.1.14.2", "4.1.14.1", "4.1.14", "4.1.14.rc2", "4.1.14.rc1", "4.1.13", "4.1.13.rc1", "4.1.12", "4.1.12.rc1", "4.1.11", "4.1.10", "4.1.10.rc4", "4.1.10.rc3", "4.1.10.rc2", "4.1.10.rc1", "4.1.9", "4.1.9.rc1", "4.1.8", "4.1.7.1", "4.1.7", "4.1.6", "4.1.6.rc2", "4.1.6.rc1", "4.1.5", "4.1.4", "4.1.3", "4.1.2", "4.1.2.rc3", "4.1.2.rc2", "4.1.2.rc1", "4.1.1", "4.1.0", "4.1.0.rc2", "4.1.0.rc1", "4.1.0.beta2", "4.1.0.beta1", "4.0.13", "4.0.13.rc1", "4.0.12", "4.0.11.1", "4.0.11", "4.0.10", "4.0.10.rc2", "4.0.10.rc1", "4.0.9", "4.0.8", "4.0.7", "4.0.6", "4.0.6.rc3", "4.0.6.rc2", "4.0.6.rc1", "4.0.5", "4.0.4", "4.0.4.rc1", "4.0.3", "4.0.2", "4.0.1", "4.0.1.rc4", "4.0.1.rc3", "4.0.1.rc2", "4.0.1.rc1", "4.0.0", "4.0.0.rc2", "4.0.0.rc1", "4.0.0.beta1", "3.2.22.5", "3.2.22.4", "3.2.22.3", "3.2.22.2", "3.2.22.1", "3.2.22", "3.2.21", "3.2.20", "3.2.19", "3.2.18", "3.2.17", "3.2.16", "3.2.15", "3.2.15.rc3", "3.2.15.rc2", "3.2.15.rc1", "3.2.14", "3.2.14.rc2", "3.2.14.rc1", "3.2.13", "3.2.13.rc2", "3.2.13.rc1", "3.2.12", "3.2.11", "3.2.10", "3.2.9", "3.2.9.rc3", "3.2.9.rc2", "3.2.9.rc1", "3.2.8", "3.2.8.rc2", "3.2.8.rc1", "3.2.7", "3.2.7.rc1", "3.2.6", "3.2.5", "3.2.4", "3.2.4.rc1", "3.2.3", "3.2.3.rc2", "3.2.3.rc1", "3.2.2", "3.2.2.rc1", "3.2.1", "3.2.0", "3.2.0.rc2", "3.2.0.rc1", "3.1.12", "3.1.11", "3.1.10", "3.1.9", "3.1.8", "3.1.7", "3.1.6", "3.1.5", "3.1.5.rc1", "3.1.4", "3.1.4.rc1", "3.1.3", "3.1.2", "3.1.2.rc2", "3.1.2.rc1", "3.1.1", "3.1.1.rc3", "3.1.1.rc2", "3.1.1.rc1", "3.1.0", "3.1.0.rc8", "3.1.0.rc6", "3.1.0.rc5", "3.1.0.rc4", "3.1.0.rc3", "3.1.0.rc2", "3.1.0.rc1", "3.1.0.beta1", "3.0.20", "3.0.19", "3.0.18", "3.0.17", "3.0.16", "3.0.15", "3.0.14", "3.0.13", "3.0.13.rc1", "3.0.12", "3.0.12.rc1", "3.0.11", "3.0.10", "3.0.10.rc1", "3.0.9", "3.0.9.rc5", "3.0.9.rc4", "3.0.9.rc3", "3.0.9.rc1", "3.0.8", "3.0.8.rc4", "3.0.8.rc2", "3.0.8.rc1", "3.0.7", "3.0.7.rc2", "3.0.7.rc1", "3.0.6", "3.0.6.rc2", "3.0.6.rc1", "3.0.5", "3.0.5.rc1", "3.0.4", "3.0.4.rc1", "3.0.3", "3.0.2", "3.0.1", "3.0.0", "3.0.pre", "3.0.0.rc2", "3.0.0.rc", "3.0.0.beta4", "3.0.0.beta3", "3.0.0.beta2", "3.0.0.beta", "2.3.18", "2.3.17", "2.3.16", "2.3.15", "2.3.14", "2.3.12", "2.3.11", "2.3.10", "2.3.9", "2.3.9.pre", "2.3.8", "2.3.8.pre1", "2.3.7", "2.3.6", "2.3.6.pre", "2.3.5", "2.3.4", "2.3.3", "2.3.2", "2.2.3", "2.2.2", "2.1.2", "2.1.1", "2.1.0", "2.0.5", "2.0.4", "2.0.2", "2.0.1", "2.0.0", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.1.1", "1.1.0", "1.0.4", "1.0.3", "1.0.2", "1.0.1", "1.0.0", "8.0.4", "8.0.3", "8.0.2.1", "8.0.2", "8.0.1", "8.0.0.1", "8.0.0", "8.0.0.rc2", "8.0.0.rc1", "8.0.0.beta1", "8.1.2", "8.1.1", "8.1.0", "8.1.0.rc1", "8.1.0.beta1"]
Secure versions: [7.2.3.1, 8.0.4.1, 8.0.5, 8.1.2.1, 8.1.3]
Recommendation: Update to version 8.1.3.
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Published date: 2026-03-23T20:53:28Z
CVE: CVE-2026-33170
Links:
- https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
- https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7
- https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
- https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://github.com/advisories/GHSA-89vf-4333-qx8v
- https://nvd.nist.gov/vuln/detail/CVE-2026-33170
Impact
SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
Releases
The fixed releases are available at the normal locations.
Affected versions: ["7.2.3", "7.2.2.2", "7.2.2.1", "7.2.2", "7.2.1.2", "7.2.1.1", "7.2.1", "7.2.0", "7.2.0.rc1", "7.2.0.beta3", "7.2.0.beta2", "7.2.0.beta1", "7.1.6", "7.1.5.2", "7.1.5.1", "7.1.5", "7.1.4.2", "7.1.4.1", "7.1.4", "7.1.3.4", "7.1.3.3", "7.1.3.2", "7.1.3.1", "7.1.3", "7.1.2", "7.1.1", "7.1.0", "7.1.0.rc2", "7.1.0.rc1", "7.1.0.beta1", "7.0.10", "7.0.9", "7.0.8.7", "7.0.8.6", "7.0.8.5", "7.0.8.4", "7.0.8.3", "7.0.8.2", "7.0.8.1", "7.0.8", "7.0.7.2", "7.0.7.1", "7.0.7", "7.0.6", "7.0.5.1", "7.0.5", "7.0.4.3", "7.0.4.2", "7.0.4.1", "7.0.4", "7.0.3.1", "7.0.3", "7.0.2.4", "7.0.2.3", "7.0.2.2", "7.0.2.1", "7.0.2", "7.0.1", "7.0.0", "7.0.0.rc3", "7.0.0.rc2", "7.0.0.rc1", "7.0.0.alpha2", "7.0.0.alpha1", "6.1.7.10", "6.1.7.9", "6.1.7.8", "6.1.7.7", "6.1.7.6", "6.1.7.5", "6.1.7.4", "6.1.7.3", "6.1.7.2", "6.1.7.1", "6.1.7", "6.1.6.1", "6.1.6", "6.1.5.1", "6.1.5", "6.1.4.7", "6.1.4.6", "6.1.4.5", "6.1.4.4", "6.1.4.3", "6.1.4.2", "6.1.4.1", "6.1.4", "6.1.3.2", "6.1.3.1", "6.1.3", "6.1.2.1", "6.1.2", "6.1.1", "6.1.0", "6.1.0.rc2", "6.1.0.rc1", "6.0.6.1", "6.0.6", "6.0.5.1", "6.0.5", "6.0.4.8", "6.0.4.7", "6.0.4.6", "6.0.4.5", "6.0.4.4", "6.0.4.3", "6.0.4.2", "6.0.4.1", "6.0.4", "6.0.3.7", "6.0.3.6", "6.0.3.5", "6.0.3.4", "6.0.3.3", "6.0.3.2", "6.0.3.1", "6.0.3", "6.0.3.rc1", "6.0.2.2", "6.0.2.1", "6.0.2", "6.0.2.rc2", "6.0.2.rc1", "6.0.1", "6.0.1.rc1", "6.0.0", "6.0.0.rc2", "6.0.0.rc1", "6.0.0.beta3", "6.0.0.beta2", "6.0.0.beta1", "5.2.8.1", "5.2.8", "5.2.7.1", "5.2.7", "5.2.6.3", "5.2.6.2", "5.2.6.1", "5.2.6", "5.2.5", "5.2.4.6", "5.2.4.5", "5.2.4.4", "5.2.4.3", "5.2.4.2", "5.2.4.1", "5.2.4", "5.2.4.rc1", "5.2.3", "5.2.3.rc1", "5.2.2.1", "5.2.2", "5.2.2.rc1", "5.2.1.1", "5.2.1", "5.2.1.rc1", "5.2.0", "5.2.0.rc2", "5.2.0.rc1", "5.2.0.beta2", "5.2.0.beta1", "5.1.7", "5.1.7.rc1", "5.1.6.2", "5.1.6.1", "5.1.6", "5.1.5", "5.1.5.rc1", "5.1.4", "5.1.4.rc1", "5.1.3", "5.1.3.rc3", "5.1.3.rc2", "5.1.3.rc1", "5.1.2", "5.1.2.rc1", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.1.0.beta1", "5.0.7.2", "5.0.7.1", "5.0.7", "5.0.6", "5.0.6.rc1", "5.0.5", "5.0.5.rc2", "5.0.5.rc1", "5.0.4", "5.0.4.rc1", "5.0.3", "5.0.2", "5.0.2.rc1", "5.0.1", "5.0.1.rc2", "5.0.1.rc1", "5.0.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "5.0.0.beta4", "5.0.0.beta3", "5.0.0.beta2", "5.0.0.beta1.1", "5.0.0.beta1", "5.0.0.racecar1", "4.2.11.3", "4.2.11.2", "4.2.11.1", "4.2.11", "4.2.10", "4.2.10.rc1", "4.2.9", "4.2.9.rc2", "4.2.9.rc1", "4.2.8", "4.2.8.rc1", "4.2.7.1", "4.2.7", "4.2.7.rc1", "4.2.6", "4.2.6.rc1", "4.2.5.2", "4.2.5.1", "4.2.5", "4.2.5.rc2", "4.2.5.rc1", "4.2.4", "4.2.4.rc1", "4.2.3", "4.2.3.rc1", "4.2.2", "4.2.1", "4.2.1.rc4", "4.2.1.rc3", "4.2.1.rc2", "4.2.1.rc1", "4.2.0", "4.2.0.rc3", "4.2.0.rc2", "4.2.0.rc1", "4.2.0.beta4", "4.2.0.beta3", "4.2.0.beta2", "4.2.0.beta1", "4.1.16", "4.1.16.rc1", "4.1.15", "4.1.15.rc1", "4.1.14.2", "4.1.14.1", "4.1.14", "4.1.14.rc2", "4.1.14.rc1", "4.1.13", "4.1.13.rc1", "4.1.12", "4.1.12.rc1", "4.1.11", "4.1.10", "4.1.10.rc4", "4.1.10.rc3", "4.1.10.rc2", "4.1.10.rc1", "4.1.9", "4.1.9.rc1", "4.1.8", "4.1.7.1", "4.1.7", "4.1.6", "4.1.6.rc2", "4.1.6.rc1", "4.1.5", "4.1.4", "4.1.3", "4.1.2", "4.1.2.rc3", "4.1.2.rc2", "4.1.2.rc1", "4.1.1", "4.1.0", "4.1.0.rc2", "4.1.0.rc1", "4.1.0.beta2", "4.1.0.beta1", "4.0.13", "4.0.13.rc1", "4.0.12", "4.0.11.1", "4.0.11", "4.0.10", "4.0.10.rc2", "4.0.10.rc1", "4.0.9", "4.0.8", "4.0.7", "4.0.6", "4.0.6.rc3", "4.0.6.rc2", "4.0.6.rc1", "4.0.5", "4.0.4", "4.0.4.rc1", "4.0.3", "4.0.2", "4.0.1", "4.0.1.rc4", "4.0.1.rc3", "4.0.1.rc2", "4.0.1.rc1", "4.0.0", "4.0.0.rc2", "4.0.0.rc1", "4.0.0.beta1", "3.2.22.5", "3.2.22.4", "3.2.22.3", "3.2.22.2", "3.2.22.1", "3.2.22", "3.2.21", "3.2.20", "3.2.19", "3.2.18", "3.2.17", "3.2.16", "3.2.15", "3.2.15.rc3", "3.2.15.rc2", "3.2.15.rc1", "3.2.14", "3.2.14.rc2", "3.2.14.rc1", "3.2.13", "3.2.13.rc2", "3.2.13.rc1", "3.2.12", "3.2.11", "3.2.10", "3.2.9", "3.2.9.rc3", "3.2.9.rc2", "3.2.9.rc1", "3.2.8", "3.2.8.rc2", "3.2.8.rc1", "3.2.7", "3.2.7.rc1", "3.2.6", "3.2.5", "3.2.4", "3.2.4.rc1", "3.2.3", "3.2.3.rc2", "3.2.3.rc1", "3.2.2", "3.2.2.rc1", "3.2.1", "3.2.0", "3.2.0.rc2", "3.2.0.rc1", "3.1.12", "3.1.11", "3.1.10", "3.1.9", "3.1.8", "3.1.7", "3.1.6", "3.1.5", "3.1.5.rc1", "3.1.4", "3.1.4.rc1", "3.1.3", "3.1.2", "3.1.2.rc2", "3.1.2.rc1", "3.1.1", "3.1.1.rc3", "3.1.1.rc2", "3.1.1.rc1", "3.1.0", "3.1.0.rc8", "3.1.0.rc6", "3.1.0.rc5", "3.1.0.rc4", "3.1.0.rc3", "3.1.0.rc2", "3.1.0.rc1", "3.1.0.beta1", "3.0.20", "3.0.19", "3.0.18", "3.0.17", "3.0.16", "3.0.15", "3.0.14", "3.0.13", "3.0.13.rc1", "3.0.12", "3.0.12.rc1", "3.0.11", "3.0.10", "3.0.10.rc1", "3.0.9", "3.0.9.rc5", "3.0.9.rc4", "3.0.9.rc3", "3.0.9.rc1", "3.0.8", "3.0.8.rc4", "3.0.8.rc2", "3.0.8.rc1", "3.0.7", "3.0.7.rc2", "3.0.7.rc1", "3.0.6", "3.0.6.rc2", "3.0.6.rc1", "3.0.5", "3.0.5.rc1", "3.0.4", "3.0.4.rc1", "3.0.3", "3.0.2", "3.0.1", "3.0.0", "3.0.pre", "3.0.0.rc2", "3.0.0.rc", "3.0.0.beta4", "3.0.0.beta3", "3.0.0.beta2", "3.0.0.beta", "2.3.18", "2.3.17", "2.3.16", "2.3.15", "2.3.14", "2.3.12", "2.3.11", "2.3.10", "2.3.9", "2.3.9.pre", "2.3.8", "2.3.8.pre1", "2.3.7", "2.3.6", "2.3.6.pre", "2.3.5", "2.3.4", "2.3.3", "2.3.2", "2.2.3", "2.2.2", "2.1.2", "2.1.1", "2.1.0", "2.0.5", "2.0.4", "2.0.2", "2.0.1", "2.0.0", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.1.1", "1.1.0", "1.0.4", "1.0.3", "1.0.2", "1.0.1", "1.0.0", "8.0.4", "8.0.3", "8.0.2.1", "8.0.2", "8.0.1", "8.0.0.1", "8.0.0", "8.0.0.rc2", "8.0.0.rc1", "8.0.0.beta1", "8.1.2", "8.1.1", "8.1.0", "8.1.0.rc1", "8.1.0.beta1"]
Secure versions: [7.2.3.1, 8.0.4.1, 8.0.5, 8.1.2.1, 8.1.3]
Recommendation: Update to version 8.1.3.
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Published date: 2026-03-23T20:52:40Z
CVE: CVE-2026-33169
Links:
- https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
- https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
- https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
- https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://github.com/advisories/GHSA-cg4j-q9v8-6v38
- https://nvd.nist.gov/vuln/detail/CVE-2026-33169
Impact
NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.
Releases
The fixed releases are available at the normal locations.
Affected versions: ["7.2.3", "7.2.2.2", "7.2.2.1", "7.2.2", "7.2.1.2", "7.2.1.1", "7.2.1", "7.2.0", "7.2.0.rc1", "7.2.0.beta3", "7.2.0.beta2", "7.2.0.beta1", "7.1.6", "7.1.5.2", "7.1.5.1", "7.1.5", "7.1.4.2", "7.1.4.1", "7.1.4", "7.1.3.4", "7.1.3.3", "7.1.3.2", "7.1.3.1", "7.1.3", "7.1.2", "7.1.1", "7.1.0", "7.1.0.rc2", "7.1.0.rc1", "7.1.0.beta1", "7.0.10", "7.0.9", "7.0.8.7", "7.0.8.6", "7.0.8.5", "7.0.8.4", "7.0.8.3", "7.0.8.2", "7.0.8.1", "7.0.8", "7.0.7.2", "7.0.7.1", "7.0.7", "7.0.6", "7.0.5.1", "7.0.5", "7.0.4.3", "7.0.4.2", "7.0.4.1", "7.0.4", "7.0.3.1", "7.0.3", "7.0.2.4", "7.0.2.3", "7.0.2.2", "7.0.2.1", "7.0.2", "7.0.1", "7.0.0", "7.0.0.rc3", "7.0.0.rc2", "7.0.0.rc1", "7.0.0.alpha2", "7.0.0.alpha1", "6.1.7.10", "6.1.7.9", "6.1.7.8", "6.1.7.7", "6.1.7.6", "6.1.7.5", "6.1.7.4", "6.1.7.3", "6.1.7.2", "6.1.7.1", "6.1.7", "6.1.6.1", "6.1.6", "6.1.5.1", "6.1.5", "6.1.4.7", "6.1.4.6", "6.1.4.5", "6.1.4.4", "6.1.4.3", "6.1.4.2", "6.1.4.1", "6.1.4", "6.1.3.2", "6.1.3.1", "6.1.3", "6.1.2.1", "6.1.2", "6.1.1", "6.1.0", "6.1.0.rc2", "6.1.0.rc1", "6.0.6.1", "6.0.6", "6.0.5.1", "6.0.5", "6.0.4.8", "6.0.4.7", "6.0.4.6", "6.0.4.5", "6.0.4.4", "6.0.4.3", "6.0.4.2", "6.0.4.1", "6.0.4", "6.0.3.7", "6.0.3.6", "6.0.3.5", "6.0.3.4", "6.0.3.3", "6.0.3.2", "6.0.3.1", "6.0.3", "6.0.3.rc1", "6.0.2.2", "6.0.2.1", "6.0.2", "6.0.2.rc2", "6.0.2.rc1", "6.0.1", "6.0.1.rc1", "6.0.0", "6.0.0.rc2", "6.0.0.rc1", "6.0.0.beta3", "6.0.0.beta2", "6.0.0.beta1", "5.2.8.1", "5.2.8", "5.2.7.1", "5.2.7", "5.2.6.3", "5.2.6.2", "5.2.6.1", "5.2.6", "5.2.5", "5.2.4.6", "5.2.4.5", "5.2.4.4", "5.2.4.3", "5.2.4.2", "5.2.4.1", "5.2.4", "5.2.4.rc1", "5.2.3", "5.2.3.rc1", "5.2.2.1", "5.2.2", "5.2.2.rc1", "5.2.1.1", "5.2.1", "5.2.1.rc1", "5.2.0", "5.2.0.rc2", "5.2.0.rc1", "5.2.0.beta2", "5.2.0.beta1", "5.1.7", "5.1.7.rc1", "5.1.6.2", "5.1.6.1", "5.1.6", "5.1.5", "5.1.5.rc1", "5.1.4", "5.1.4.rc1", "5.1.3", "5.1.3.rc3", "5.1.3.rc2", "5.1.3.rc1", "5.1.2", "5.1.2.rc1", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.1.0.beta1", "5.0.7.2", "5.0.7.1", "5.0.7", "5.0.6", "5.0.6.rc1", "5.0.5", "5.0.5.rc2", "5.0.5.rc1", "5.0.4", "5.0.4.rc1", "5.0.3", "5.0.2", "5.0.2.rc1", "5.0.1", "5.0.1.rc2", "5.0.1.rc1", "5.0.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "5.0.0.beta4", "5.0.0.beta3", "5.0.0.beta2", "5.0.0.beta1.1", "5.0.0.beta1", "5.0.0.racecar1", "4.2.11.3", "4.2.11.2", "4.2.11.1", "4.2.11", "4.2.10", "4.2.10.rc1", "4.2.9", "4.2.9.rc2", "4.2.9.rc1", "4.2.8", "4.2.8.rc1", "4.2.7.1", "4.2.7", "4.2.7.rc1", "4.2.6", "4.2.6.rc1", "4.2.5.2", "4.2.5.1", "4.2.5", "4.2.5.rc2", "4.2.5.rc1", "4.2.4", "4.2.4.rc1", "4.2.3", "4.2.3.rc1", "4.2.2", "4.2.1", "4.2.1.rc4", "4.2.1.rc3", "4.2.1.rc2", "4.2.1.rc1", "4.2.0", "4.2.0.rc3", "4.2.0.rc2", "4.2.0.rc1", "4.2.0.beta4", "4.2.0.beta3", "4.2.0.beta2", "4.2.0.beta1", "4.1.16", "4.1.16.rc1", "4.1.15", "4.1.15.rc1", "4.1.14.2", "4.1.14.1", "4.1.14", "4.1.14.rc2", "4.1.14.rc1", "4.1.13", "4.1.13.rc1", "4.1.12", "4.1.12.rc1", "4.1.11", "4.1.10", "4.1.10.rc4", "4.1.10.rc3", "4.1.10.rc2", "4.1.10.rc1", "4.1.9", "4.1.9.rc1", "4.1.8", "4.1.7.1", "4.1.7", "4.1.6", "4.1.6.rc2", "4.1.6.rc1", "4.1.5", "4.1.4", "4.1.3", "4.1.2", "4.1.2.rc3", "4.1.2.rc2", "4.1.2.rc1", "4.1.1", "4.1.0", "4.1.0.rc2", "4.1.0.rc1", "4.1.0.beta2", "4.1.0.beta1", "4.0.13", "4.0.13.rc1", "4.0.12", "4.0.11.1", "4.0.11", "4.0.10", "4.0.10.rc2", "4.0.10.rc1", "4.0.9", "4.0.8", "4.0.7", "4.0.6", "4.0.6.rc3", "4.0.6.rc2", "4.0.6.rc1", "4.0.5", "4.0.4", "4.0.4.rc1", "4.0.3", "4.0.2", "4.0.1", "4.0.1.rc4", "4.0.1.rc3", "4.0.1.rc2", "4.0.1.rc1", "4.0.0", "4.0.0.rc2", "4.0.0.rc1", "4.0.0.beta1", "3.2.22.5", "3.2.22.4", "3.2.22.3", "3.2.22.2", "3.2.22.1", "3.2.22", "3.2.21", "3.2.20", "3.2.19", "3.2.18", "3.2.17", "3.2.16", "3.2.15", "3.2.15.rc3", "3.2.15.rc2", "3.2.15.rc1", "3.2.14", "3.2.14.rc2", "3.2.14.rc1", "3.2.13", "3.2.13.rc2", "3.2.13.rc1", "3.2.12", "3.2.11", "3.2.10", "3.2.9", "3.2.9.rc3", "3.2.9.rc2", "3.2.9.rc1", "3.2.8", "3.2.8.rc2", "3.2.8.rc1", "3.2.7", "3.2.7.rc1", "3.2.6", "3.2.5", "3.2.4", "3.2.4.rc1", "3.2.3", "3.2.3.rc2", "3.2.3.rc1", "3.2.2", "3.2.2.rc1", "3.2.1", "3.2.0", "3.2.0.rc2", "3.2.0.rc1", "3.1.12", "3.1.11", "3.1.10", "3.1.9", "3.1.8", "3.1.7", "3.1.6", "3.1.5", "3.1.5.rc1", "3.1.4", "3.1.4.rc1", "3.1.3", "3.1.2", "3.1.2.rc2", "3.1.2.rc1", "3.1.1", "3.1.1.rc3", "3.1.1.rc2", "3.1.1.rc1", "3.1.0", "3.1.0.rc8", "3.1.0.rc6", "3.1.0.rc5", "3.1.0.rc4", "3.1.0.rc3", "3.1.0.rc2", "3.1.0.rc1", "3.1.0.beta1", "3.0.20", "3.0.19", "3.0.18", "3.0.17", "3.0.16", "3.0.15", "3.0.14", "3.0.13", "3.0.13.rc1", "3.0.12", "3.0.12.rc1", "3.0.11", "3.0.10", "3.0.10.rc1", "3.0.9", "3.0.9.rc5", "3.0.9.rc4", "3.0.9.rc3", "3.0.9.rc1", "3.0.8", "3.0.8.rc4", "3.0.8.rc2", "3.0.8.rc1", "3.0.7", "3.0.7.rc2", "3.0.7.rc1", "3.0.6", "3.0.6.rc2", "3.0.6.rc1", "3.0.5", "3.0.5.rc1", "3.0.4", "3.0.4.rc1", "3.0.3", "3.0.2", "3.0.1", "3.0.0", "3.0.pre", "3.0.0.rc2", "3.0.0.rc", "3.0.0.beta4", "3.0.0.beta3", "3.0.0.beta2", "3.0.0.beta", "2.3.18", "2.3.17", "2.3.16", "2.3.15", "2.3.14", "2.3.12", "2.3.11", "2.3.10", "2.3.9", "2.3.9.pre", "2.3.8", "2.3.8.pre1", "2.3.7", "2.3.6", "2.3.6.pre", "2.3.5", "2.3.4", "2.3.3", "2.3.2", "2.2.3", "2.2.2", "2.1.2", "2.1.1", "2.1.0", "2.0.5", "2.0.4", "2.0.2", "2.0.1", "2.0.0", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.1.1", "1.1.0", "1.0.4", "1.0.3", "1.0.2", "1.0.1", "1.0.0", "8.0.4", "8.0.3", "8.0.2.1", "8.0.2", "8.0.1", "8.0.0.1", "8.0.0", "8.0.0.rc2", "8.0.0.rc1", "8.0.0.beta1", "8.1.2", "8.1.1", "8.1.0", "8.1.0.rc1", "8.1.0.beta1"]
Secure versions: [7.2.3.1, 8.0.4.1, 8.0.5, 8.1.2.1, 8.1.3]
Recommendation: Update to version 8.1.3.
502 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 5.1.0.beta1 | MIT | 9 | 2017-02-23 - 19:54 | about 9 years |
| 5.0.7.2 | MIT | 9 | 2019-03-13 - 16:40 | about 7 years |
| 5.0.7.1 | MIT | 9 | 2018-11-27 - 20:08 | over 7 years |
| 5.0.7 | MIT | 9 | 2018-03-29 - 17:58 | almost 8 years |
| 5.0.6 | MIT | 9 | 2017-09-08 - 00:45 | over 8 years |
| 5.0.6.rc1 | MIT | 9 | 2017-08-24 - 19:09 | over 8 years |
| 5.0.5 | MIT | 9 | 2017-07-31 - 19:03 | over 8 years |
| 5.0.5.rc2 | MIT | 9 | 2017-07-25 - 20:24 | over 8 years |
| 5.0.5.rc1 | MIT | 9 | 2017-07-19 - 19:42 | over 8 years |
| 5.0.4 | MIT | 9 | 2017-06-19 - 21:57 | almost 9 years |
| 5.0.4.rc1 | MIT | 9 | 2017-06-14 - 20:47 | almost 9 years |
| 5.0.3 | MIT | 9 | 2017-05-12 - 20:03 | almost 9 years |
| 5.0.2 | MIT | 9 | 2017-03-01 - 23:12 | about 9 years |
| 5.0.2.rc1 | MIT | 9 | 2017-02-25 - 00:54 | about 9 years |
| 5.0.1 | MIT | 9 | 2016-12-21 - 00:06 | over 9 years |
| 5.0.1.rc2 | MIT | 9 | 2016-12-09 - 19:11 | over 9 years |
| 5.0.1.rc1 | MIT | 9 | 2016-11-30 - 20:01 | over 9 years |
| 5.0.0.1 | MIT | 9 | 2016-08-11 - 17:34 | over 9 years |
| 5.0.0 | MIT | 9 | 2016-06-30 - 21:20 | over 9 years |
| 5.0.0.rc2 | MIT | 8 | 2016-06-22 - 20:02 | almost 10 years |
| 5.0.0.rc1 | MIT | 8 | 2016-05-06 - 21:55 | almost 10 years |
| 5.0.0.beta4 | MIT | 8 | 2016-04-27 - 20:53 | almost 10 years |
| 5.0.0.beta3 | MIT | 8 | 2016-02-24 - 16:15 | about 10 years |
| 5.0.0.beta2 | MIT | 8 | 2016-02-01 - 22:05 | about 10 years |
| 5.0.0.beta1.1 | MIT | 8 | 2016-01-25 - 19:26 | about 10 years |
| 5.0.0.beta1 | MIT | 8 | 2015-12-18 - 21:17 | over 10 years |
| 5.0.0.racecar1 | MIT | 8 | 2016-05-06 - 22:00 | almost 10 years |
| 4.2.11.3 | MIT | 8 | 2020-05-15 - 18:34 | almost 6 years |
| 4.2.11.2 | MIT | 8 | 2020-05-15 - 16:30 | almost 6 years |
| 4.2.11.1 | MIT | 8 | 2019-03-13 - 16:37 | about 7 years |
| 4.2.11 | MIT | 8 | 2018-11-27 - 20:06 | over 7 years |
| 4.2.10 | MIT | 8 | 2017-09-27 - 14:26 | over 8 years |
| 4.2.10.rc1 | MIT | 8 | 2017-09-20 - 19:41 | over 8 years |
| 4.2.9 | MIT | 8 | 2017-06-26 - 21:29 | almost 9 years |
| 4.2.9.rc2 | MIT | 8 | 2017-06-19 - 22:27 | almost 9 years |
| 4.2.9.rc1 | MIT | 8 | 2017-06-13 - 18:49 | almost 9 years |
| 4.2.8 | MIT | 8 | 2017-02-21 - 16:07 | about 9 years |
| 4.2.8.rc1 | MIT | 8 | 2017-02-10 - 02:44 | about 9 years |
| 4.2.7.1 | MIT | 8 | 2016-08-11 - 17:34 | over 9 years |
| 4.2.7 | MIT | 8 | 2016-07-13 - 02:54 | over 9 years |
| 4.2.7.rc1 | MIT | 8 | 2016-07-01 - 00:30 | over 9 years |
| 4.2.6 | MIT | 8 | 2016-03-07 - 22:31 | about 10 years |
| 4.2.6.rc1 | MIT | 8 | 2016-03-01 - 18:36 | about 10 years |
| 4.2.5.2 | MIT | 8 | 2016-02-29 - 19:15 | about 10 years |
| 4.2.5.1 | MIT | 8 | 2016-01-25 - 19:25 | about 10 years |
| 4.2.5 | MIT | 8 | 2015-11-12 - 17:04 | over 10 years |
| 4.2.5.rc2 | MIT | 8 | 2015-11-05 - 03:00 | over 10 years |
| 4.2.5.rc1 | MIT | 8 | 2015-10-30 - 20:46 | over 10 years |
| 4.2.4 | MIT | 8 | 2015-08-24 - 18:24 | over 10 years |
| 4.2.4.rc1 | MIT | 8 | 2015-08-14 - 15:19 | over 10 years |