Bug #39190: CVE-2026-33176: Active Support Denial of Service via large scientific notation strings - Foreman

Actions

Copy link

Bug #39190

closed

CVE-2026-33176: Active Support Denial of Service via large scientific notation strings

Added by Ondřej Gajdušek 2 months ago. Updated 26 days ago.

Status:

Closed

Priority:

High

Assignee:

Ondřej Gajdušek

Category:

Packaging

Target version:

3.19.0

Difficulty:

Triaged:

Bugzilla link:

Pull request:

https://github.com/theforeman/foreman-packaging/pull/13315, https://github.com/theforeman/foreman-packaging/pull/13320, https://github.com/theforeman/foreman-packaging/pull/13321

Fixed in Releases:

3.17.3, 3.18.2, 3.19.0

Found in Releases:

3.17.3, 3.18.1

Red Hat JIRA:

SAT-43700

Description

Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which BigDecimal expands into extremely large decimal representations. This causes excessive memory allocation and
CPU consumption when the expanded number is formatted, resulting in a potential DoS vulnerability.

Rails 7.0 is no longer maintained upstream. Backport the security fix from supported Rails versions to the Foreman packaging project.

Upstream fix commit (Rails 7.2+):
https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a

Security advisory:
https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9