--- title: "Rails ActiveSupport vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/rails/activesupport type: product description: "Rails ActiveSupport has 13 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-03-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Rails ActiveSupport vulnerabilities Vendor: [Rails](https://radicalnotion.ai/vendor/rails) - **Published CVEs:** 13 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 13 - **Average CVSS:** 5.4 - **First CVE:** 2009-09-08 - **Latest CVE:** 2026-03-23 - **Ecosystems:** gem ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 1 | | Medium | 12 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 3 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 | | [CWE-732](https://radicalnotion.ai/cwe/cwe-732) | Incorrect Permission Assignment for Critical Resource | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2015 | 2 | | 2016 | 0 | | 2017 | 0 | | 2018 | 0 | | 2019 | 0 | | 2020 | 0 | | 2021 | 0 | | 2022 | 0 | | 2023 | 1 | | 2024 | 0 | | 2025 | 2 | | 2026 | 3 | ## Affected versions (top 27 of 56) | Version | Kind | CVEs | | --- | --- | --- | | \< 7.2.3.1 | exact | 3 | | \>= 8.0.0.beta1, \< 8.0.4.1 | exact | 3 | | \>= 8.1.0.beta1, \< 8.1.2.1 | exact | 3 | | \< 7.2.3.1 | range | 3 | | 8.0.0.beta1 \<= v \< 8.0.4.1 | range | 3 | | 8.1.0.beta1 \<= v \< 8.1.2.1 | range | 3 | | \< 2.3.16 | range | 1 | | \< 3.2.22 | range | 1 | | \< 6.1.7.1 | range | 1 | | \>= 5.2.0 | range | 1 | | 2.0.0 \<= v \< 2.3.12 | range | 1 | | 2.0.0 \<= v \< 2.3.13 | range | 1 | | 2.1.0 \<= v \< 2.2.3 | range | 1 | | 2.3.0 \<= v \< 2.3.4 | range | 1 | | 3.0.0 \<= v \< 3.0.10 | range | 1 | | 7.2.3.1 | patched | 3 | | 8.0.4.1 | patched | 3 | | 8.1.2.1 | patched | 3 | | 4.1.11 | patched | 2 | | 4.2.2 | patched | 2 | | 2.2.3 | patched | 1 | | 2.3.12 | patched | 1 | | 2.3.13 | patched | 1 | | 2.3.16 | patched | 1 | | 2.3.4 | patched | 1 | | 3.0.10 | patched | 1 | | 3.0.17 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-33176 | Rails Active Support has a possible DoS vulnerability in its number helpers | medium | 6.6 | No | No | Yes | | CVE-2026-33170 | Rails Active Support has a possible XSS vulnerability in SafeBuffer#% | medium | 5.3 | No | No | Yes | | CVE-2026-33169 | Rails Active Support has a possible ReDoS vulnerability in number\_to\_delimited | medium | 6.9 | No | No | Yes | | CVE-2023-38037 | Active Support Possibly Discloses Locally Encrypted Files | medium | 5.5 | No | No | Yes | | CVE-2023-28120 | Possible XSS Security Vulnerability in SafeBuffer#bytesplice | medium | 5.3 | No | No | Yes | | CVE-2023-22796 | ReDoS based DoS vulnerability in Active Support's underscore | high | 7.5 | No | No | Yes | | CVE-2015-3227 | activesupport vulnerable to Denial of Service via large XML document depth | medium | 5.0 | No | No | Yes | | CVE-2015-3226 | activesupport Cross-site Scripting vulnerability | medium | 4.3 | No | No | Yes | | CVE-2013-1856 | activesupport Improper Input Validation vulnerability | medium | 5.8 | No | No | Yes | | CVE-2012-3464 | activesupport Cross-site Scripting vulnerability | medium | 4.3 | No | No | Yes | | CVE-2011-2932 | activesupport Cross-site Scripting vulnerability | medium | 4.3 | No | No | Yes | | CVE-2011-2197 | rails Cross-site Scripting vulnerability | medium | 4.3 | No | No | Yes | | CVE-2009-3086 | actionpack and activesupport vulnerable to information leaks | medium | 5.0 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Rails ActiveSupport have? Rails ActiveSupport has 13 published CVE records since 2009. ### How many Rails ActiveSupport CVEs are in CISA KEV? None of Rails ActiveSupport's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Rails ActiveSupport vulnerabilities? No Rails ActiveSupport CVEs currently have a tracked public exploit in this dataset. ### Which versions of Rails ActiveSupport are affected? 56 distinct Rails ActiveSupport versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Rails ActiveSupport CVEs? Rails ActiveSupport's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-20 (Improper Input Validation), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). ### What is the average severity of Rails ActiveSupport CVEs? The average CVSS base score across Rails ActiveSupport's scored CVEs is 5.4. ## Other products from this vendor - [rails](https://radicalnotion.ai/vendor/rails/rails) (110 CVEs) - [actionpack](https://radicalnotion.ai/vendor/rails/actionpack) (46 CVEs) - [activerecord](https://radicalnotion.ai/vendor/rails/activerecord) (15 CVEs) - [rails-html-sanitizer](https://radicalnotion.ai/vendor/rails/rails-html-sanitizer) (15 CVEs) - [activestorage](https://radicalnotion.ai/vendor/rails/activestorage) (9 CVEs) - [actionview](https://radicalnotion.ai/vendor/rails/actionview) (8 CVEs) - [https://github.com/rails/rails](https://radicalnotion.ai/vendor/rails/https-github-com-rails-rails) (3 CVEs) - [actionmailer](https://radicalnotion.ai/vendor/rails/actionmailer) (2 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/rails/activesupport). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.