Rails Active Storage HTTP Range Header DoS Vulnerability

A denial-of-service vulnerability has been identified in Rails Active Storage versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1. The issue arises in the proxy controller, which fails to limit the number of byte ranges in an HTTP Range header. This oversight allows requests with thousands of small ranges to cause excessive CPU usage, disproportionately affecting server performance compared to normal file requests.

Impact

Exploitation of this vulnerability can lead to significant increased CPU usage, causing a denial-of-service condition on the server.

Remediation

Users can upgrade to Active Storage versions 8.1.2.1, 8.0.4.1, or 7.2.3.1 to address this vulnerability.