---
id: "GHSA-hfr4-8rjc-97m2"
page: "https://infrastack.ai/live/GHSA-hfr4-8rjc-97m2"
kind: "vulnerability"
aliases: ["GHSA-hfr4-8rjc-97m2"]
title: "Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "activestorage", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "activestorage", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["activestorage", "cwe-602", "google-cloud-storage", "package", "rails", "ruby"]
not_affected_if: ["no-direct-uploads", "no-gcs-service", "static-export"]
published_at: "2026-11-04T03:02:06+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:56:27+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage

Link for people: https://infrastack.ai/live/GHSA-hfr4-8rjc-97m2 (this .md is for agents)

Active Storage's Google Cloud Storage direct-upload URLs do not bind the declared file size, so a client can upload a larger file than it declared. The stored blob keeps the declared size, which can bypass application size validations and quotas.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:activestorage affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:activestorage affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Look for `activestorage` in `Gemfile.lock` and compare its version with the fixed ranges.
- Check whether the app uses `ActiveStorage` with the `google` service in `config/storage.yml` and accepts direct uploads.
- Check whether the bucket CORS configuration lists `x-goog-content-length-range` in `responseHeader`.

## Fix

- `activestorage` `8.1.4.1` for the 8.1 line
- `activestorage` `8.0.5.2` for the 8.0 line
- Patches for teams that cannot upgrade yet are linked in the advisory (commits for 8.1 and 8.0).
- After upgrading, add `x-goog-content-length-range` to the bucket CORS `responseHeader` list, or browser direct uploads fail.

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2

## From the sources

### Impact
`ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the declared content length into the signed direct-upload URL, and `#headers_for_direct_upload` returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the `byte_size` it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service.

Applications that store files in Google Cloud Storage and accept direct uploads are affected.

### Details
The fixed releases sign an `x-goog-content-length-range` header that matches the blob's declared `byte_size` and return it from `headers_for_direct_upload`, so Cloud Storage rejects an upload body of any other size. Browsers send this header with the direct upload, so a bucket's CORS configuration must list `x-goog-content-length-range` in `responseHeader`, or browser direct uploads fail after the upgrade. The Active Storage CHANGELOG and the CORS example in the Active Storage guide show the change.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7.patch
- 8.0: https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c.patch

### Credit
This issue was responsibly reported by HackerOne researcher [f4cts](https://hackerone.com/f4cts).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_