Ruby on Rails · Report #2814774

Possible DoS in NumberHelpers

Validstatus

mediumseverity

18upvotes

6 Oct 2026disclosed

Summary

Active Support's number helpers accepted strings in scientific notation. BigDecimal parses a string such as "11288E822220222" into a number with hundreds of trillions of digits, and formatting that number exhausts memory or ties up the CPU. An application that passes user input to number_to_currency, number_to_percentage or another number helper can be taken down by a single request.

CVE-2026-33176 fixes this in Active Support 7.2.3.1, 8.0.4.1 and 8.1.2.1. The helpers now treat any string containing e or d as non-numeric and return it unchanged, as they already did for other non-numeric input.

Thanks to @manun for the report.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original