Active Storage’s proxy controller parses HTTP Range headers without limiting the number of byte ranges. An attacker can send a request that contains thousands of very small ranges, forcing the server to process each one individually. Because each element in the range list consumes CPU cycles, the resulting request can disproportionately exhaust server resources, potentially slowing or suspending legitimate traffic. This vulnerability is classified as a resource exhaustion denial of service under CWE‑770.

The issue applies to the Rails Active Storage component in all Rails releases that precede version 8.1.2.1, 8.0.4.1, and 7.2.3.1. Any application running these older major or minor releases, whether using cloud or local file attachments, is vulnerable. Updating to the mentioned patched releases removes the problem.

The CVSS score of 2.3 indicates a low severity rating, and no EPSS score is provided. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector, inferred from the description, is an unauthenticated HTTP request to the application’s proxy endpoint, which is typically reachable from the public Internet. Even though exploitation is simple and requires no credentials, the low score and limited evidence of active exploitation suggest a relatively modest threat at present. However, high‑traffic services could still suffer performance degradation if the vector is abused.