{"id":"GHSA-4v2w-w6g6-f8f8","summary":"Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming","details":"### Impact\nWhen Active Storage serves a file through its proxy controllers, `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage service by calling `head` to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and `head` replaces the response body while the server is still reading the original `ActionController::Live` buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability.\n\nApplications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition.\n\n### Details\nA storage error raised before the response is committed still produces a 404 or 500 response. After the fix, a storage error raised after the response is committed is re-raised instead, so the server closes the streamed response and releases the thread; the client receives a truncated body, and the exception reaches the application's error reporting.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009.patch\n- 8.0: https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-FMPUMYTB).","aliases":["CVE-2026-126071"],"modified":"2026-11-10T21:45:04.235740111Z","published":"2026-11-10T21:24:31Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-772"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-11-10T21:24:31Z"},"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8"},{"type":"WEB","url":"https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009"},{"type":"WEB","url":"https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml"}],"affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0.beta1"},{"fixed":"8.0.5.2"}]}],"versions":["8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}