CVE-2026-33176

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description Active Support number helpers are susceptible to a denial-of-service condition. The number helpers accept strings containing scientific notation, such as 1e10000, which are expanded into extremely large decimal representations by BigDecimal. This expansion can lead to excessive memory allocation and CPU usage during formatting, potentially causing a DoS.

Recommendations Update to Active Support version 8.1.2.1 or later. Update to Active Support version 8.0.4.1 or later. Update to Active Support version 7.2.3.1 or later.