Ruby on Rails Active Storage prior 8.0.5.2/8.1.4.1 GCS Service GCSService#url_for_direct_upload allocation of resources

Summaryinfo

A vulnerability marked as problematic has been reported in Ruby on Rails Active Storage. This impacts the function ActiveStorage::Service::GCSService#url_for_direct_upload of the component GCS Service. Performing a manipulation results in allocation of resources. This vulnerability is cataloged as CVE-2026-126085. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Ruby on Rails Active Storage. It has been classified as problematic. This affects the function ActiveStorage::Service::GCSService#url_for_direct_upload of the component GCS Service. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. This is going to have an impact on integrity. The summary by CVE is:

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-126085 since 11/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 8.0.5.2 or 8.1.4.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• Ruby on Rails

Name

• Active Storage

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion