CVE-2026-126085: Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads

CVE-2026-126085 · Severity: medium · CVSS 5.3 · Published 2026-11-10

Rails applications using Active Storage for direct uploads to Google Cloud Storage fail to enforce file size limits. An attacker can upload files larger than the declared size limit, bypassing application-level quotas and file size validations. This affects any web application using Rails that accepts direct uploads to Google Cloud Storage.

Technologies: activestorage (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126085 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126085 being exploited in the wild.
How severe is CVE-2026-126085?
Medium severity, with a CVSS score of 5.3, published 10 November 2026.
Which products and versions are affected?
Rails versions prior to the patched releases; activestorage (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126085?
Yes. activestorage (RubyGems): upgrade to 8.1.4.1 or later. Until then: Update the CORS configuration for the Google Cloud Storage bucket to include x-goog-content-length-range in the responseHeader list, or apply the provided patches to ActiveStorage::Service::GCSService before upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126085 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126085?
Check whether you run Rails or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • activestorage (RubyGems): upgrade to 8.1.4.1 or later
    bundle update activestorage

Update the CORS configuration for the Google Cloud Storage bucket to include x-goog-content-length-range in the responseHeader list, or apply the provided patches to ActiveStorage::Service::GCSService before upgrading.

Technical details

The vulnerability exists in ActiveStorage::Service::GCSService#url_for_direct_upload, which does not include the x-goog-content-length-range header in the signed URL or headers for direct upload, allowing clients to upload objects of any size despite declared byte_size constraints. An attacker with upload capability can store arbitrarily large files while the system records the declared smaller size. The fix binds the content-length range in signed URLs and returns the constraint header, allowing Cloud Storage to reject non-matching upload sizes.

Affected products

  • Rails Rails versions prior to the patched releases

Identifiers

  • CVE-2026-126085
  • GHSA-hfr4-8rjc-97m2

Timeline

  • 2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.