Ruby on Rails Active Storage: Denial of service via proxy mode storage errors
Summary
Active Storage in Ruby on Rails does not release a streaming response buffer when a storage error occurs after the first chunk of a file download has already been sent. The affected server thread then blocks until the process restarts. Applications that store files on Amazon S3, S3-compatible services or Google Cloud Storage and use the default Active Storage routes are affected. Repeated failed downloads, for example after a file is deleted during a download, could exhaust server threads and cause a denial of service.
Affected
- Active Storage 8.0 before 8.0.5.2
- Active Storage 8.1 before 8.1.4.1
Fixed in
- 8.0.5.2
- 8.1.4.1
Workaround
- Unknown. Apply the linked patch commits if an immediate upgrade is not possible.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
Our recommendation
- Identify Rails applications that use activestorage (check Gemfile.lock).
- Upgrade to Rails 8.1.4.1 or later. Rails 8.0 security support ends on Nov 7, 2026, so move to 8.1 rather than staying on 8.0.
- Upgrade together with the ImageMagick fix GHSA-f3w6-w445-fwh9 in the same release.
- Monitor thread usage and error logs for hung requests on download routes until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4v2w-w6g6-f8f8 github.com
- Rails 8.1.4.1 release tag github.com
- Rails 8.0.5.2 release tag github.com
- Fix commit for 8.1 line github.com
- Fix commit for 8.0 line github.com
- Rails security release announcement rubyonrails.org
- CVE record summary (CVE-2026-126071) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:15.
Original description (NVD)
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles an error from the storage service by calling head to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and head replaces the response body while the server is still reading the original ActionController::Live buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability. Applications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009
- https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.