Object number helpers within Ruby on Rails ActiveSupport can process strings formatted in scientific notation such as `1e10000`. Prior to the fix, the BigDecimal library expands these values into extremely large decimal representations, leading the formatter to allocate extravagant amounts of memory and perform costly computations. An attacker who can provide such oversized numeric input to the application can trigger these resource consumption spikes and cause a denial of service.

The vulnerability afflicts the ActiveSupport component of the Ruby on Rails framework in the versions preceding 8.1.2.1, 8.0.4.1, and 7.2.3.1. Any Rails application using an older release or embedding a vulnerable ActiveSupport library is potentially exposed.

The CVSS v3.1 base score is 6.6, indicating a medium-high severity. The EPSS probability is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation through input that includes large scientific notation numbers; the explosion of memory usage can be triggered by legitimate application traffic, making a front‑end denial of service possible once the formatter is invoked.