Active Storage, the file attachment framework in Rails, contains a flaw where the proxy delivery mode reads the entire requested byte range into memory before transmitting it to the client. If a requester sends a very large or unbounded Range header, such as `bytes=0-`, the server allocates memory proportional to the file size, which can exhaust its resources and render the application unresponsive. This constitutes a classic denial‑of‑service vulnerability and is catalogued as CWE‑770 (Resource Exhaustion by Unbounded Increment) and CWE‑789 (Out‑of‑Bounds Write).

The flaw affects Rails applications that use Active Storage in proxy delivery mode on versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1. All Rails releases before those patches are vulnerable; the issue has been fixed in the mentioned release versions and subsequent Rails releases.

The CVSS base score is 6.6, indicating a medium severity, and the EPSS score is less than 1 percent, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can trigger the issue by crafting HTTP requests with large or open Range headers to the application’s Active Storage proxy endpoint. Based on the description, the intended attack vector is from external parties capable of sending arbitrary HTTP requests to the application. Successful exploitation would consume server memory, potentially causing the process to be killed or the application to become significantly slower, leading to service interruptions for legitimate users.