CVE-2026-126071

Name of the Vulnerable Software and Affected Versions Active Storage versions 8.0 through 8.0.5.1 Active Storage versions 8.1 through 8.1.4.0

Description When serving files through proxy controllers, the ActiveStorage::Streaming#send blob stream function handles storage service errors by calling head to send a 404 or 500 response. If an error occurs after the first chunk has been written, the response is already committed, and head replaces the response body while the server continues reading the original ActionController::Live buffer. Because this buffer is never closed, the server thread handling the request blocks until the process restarts. This can lead to a Denial of Service (DoS) if repeated failed downloads exhaust the server's threads. This issue affects applications using default Active Storage routes and storage services that stream downloads in several requests, such as Amazon S3, S3-compatible services, or Google Cloud Storage. The condition is triggered by any storage error occurring partway through a download, including the deletion of a file while it is being served.

Recommendations Update to version 8.0.5.2 Update to version 8.1.4.1