HackerOne Disclosed Reports - 2026-10-06

Medium
resolved

Possible DoS in NumberHelpers

Bug reported by Manu was disclosed at October 6, 2026, 6:43 pm   |   Uncontrolled Resource Consumption

A denial of service vulnerability was discovered in Active Support's number helpers. The vulnerability allowed strings in scientific notation to be accepted and processed, which could cause excessive memory consumption or CPU exhaustion. The issue was addressed in patched versions where number helpers now treat strings containing scientific notation characters as non-numeric input and return them unchanged.