CVE-2026-126085

Name of the Vulnerable Software and Affected Versions Active Storage versions prior to 8.1.4.1 Active Storage versions prior to 8.0.5.2

Description Applications using Google Cloud Storage for direct uploads are affected by an issue where the url for direct upload function in ActiveStorage::Service::GCSService fails to bind the declared content length into the signed direct-upload URL. Additionally, the headers for direct upload function returns no length constraint, allowing the URL to authorize an upload body of any size. A client could upload a file larger than the declared byte size, which may allow the bypass of application file size validations and quotas.

Recommendations Update to version 8.1.4.1 or later. Update to version 8.0.5.2 or later. Ensure the Google Cloud Storage bucket CORS configuration includes x-goog-content-length-range in the responseHeader to prevent browser direct upload failures.