The vulnerability resides in ActiveSupport’s NumberToDelimitedConverter, which uses a lookahead‑based regular expression with gsub! to add thousands delimiters. The combination of the repeated lookahead group and the in‑place gsub! call can trigger quadratic time complexity when processing long digit strings. As the input grows, the number of regex operations grows faster than linear, leading to excessive CPU usage and potential denial of service. This is a classic case of resource exhaustion (CWE‑400) coupled with a regex backtracking flaw (CWE‑1333).

The issue is present in the Rails ActiveSupport library shipped with the Rails framework. It affects all Rails releases prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1. Those earlier versions will handle numbers containing long numeric sequences with the vulnerable regex, whereas the patched releases have fixed the regex pattern to avoid the quadratic behavior.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector likely involves supplying a very long numeric string to any code path that calls number_to_delimited, such as form inputs, API payloads, or templating helper calls. An attacker with the ability to send such input can cause the Ruby interpreter to consume large amounts of CPU time, potentially leading to service degradation or crash if resources are exhausted.