CVE-2026-126085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126085", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.285Z", "datePublished": "2026-11-10T21:12:44.814Z", "dateUpdated": "2026-11-10T21:12:44.814Z"}, "containers": {"cna": {"title": "Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage", "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "lang": "en", "description": "CWE-602: Client-Side Enforcement of Server-Side Security", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2"}, {"name": "https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c"}, {"name": "https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7"}, {"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 8.1, < 8.1.4.1", "status": "affected"}, {"version": "< 8.0.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T21:12:44.814Z"}, "descriptions": [{"lang": "en", "value": "Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "source": {"advisory": "GHSA-hfr4-8rjc-97m2", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "rails", "vendor": "rails", "versions": [{"status": "affected", "version": ">= 8.1, < 8.1.4.1"}, {"status": "affected", "version": "< 8.0.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "id": "CVE-2026-126085", "lastModified": "2026-11-12T22:11:01.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-10T22:18:31.413", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "activestorage: Active Storage: File size validation bypass via missing direct-upload content length constraints", "id": "2571281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571281"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-807", "details": ["A flaw was found in Active Storage. A remote attacker can bypass application file size validations and storage quotas when direct uploads to Google Cloud Storage (GCS) are used. The service fails to bind content length restrictions into signed direct-upload URLs, allowing an attacker to upload files that exceed the declared size limit."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126085", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}], "public_date": "2026-11-10T21:12:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126085\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126085\nhttps://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c\nhttps://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7\nhttps://github.com/rails/rails/releases/tag/v8.0.5.2\nhttps://github.com/rails/rails/releases/tag/v8.1.4.1\nhttps://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2"], "statement": "This vulnerability is rated as Moderate severity because it is limited to bypassing application-level file size constraints or storage quotas without enabling arbitrary code execution or data disclosure. Impact is confined to environments utilizing Active Storage specifically configured to handle direct client uploads backed by Google Cloud Storage. Applications that route file uploads through the server, utilize other cloud backends, or disable direct uploads entirely remain unaffected by this issue.", "threat_severity": "Moderate"}

{"created": "2026-11-12T01:00:09.863276+00:00", "updated": "2026-11-12T16:15:05.450863+00:00", "vendors": []}