CVE-2026-126071

### Impact When Active Storage serves a file through its proxy controllers, `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage service by calling `head` to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and `head` replaces the response body while the server is still reading the original `ActionController::Live` buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability. Applications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition. ### Details A storage error raised before the response is committed still produces a 404 or 500 response. After the fix, a storage error raised after the response is committed is re-raised instead, so the server closes the streamed response and releases the thread; the client receives a truncated body, and the exception reaches the application's error reporting. ### Releases The fixed releases are available at the normal locations. Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009.patch - 8.0: https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82.patch ### Credit This issue was found by the Anthropic OSS Scanner (ANT-2026-FMPUMYTB).