AZL-113813: CVE-2026-126351 affecting package rubygem-addressable 2.9.0-1
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalizepath repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalizedpath, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygem-addressableto a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications are exposed when they process sufficiently long attacker-controlled URIs through Addressable normalization, path normalization, joining, or URI comparison operations. URI.parse by itself, and code that does not normalize, compare, or join untrusted URIs, is unaffected.
What must an attacker provide to trigger the issue?
An attacker needs to cause the application to process a sufficiently long, attacker-controlled URI. The costly behavior occurs when nested dot segments are repeatedly scanned and rewritten during path normalization.
Are Ruby applications on all implementations affected?
Yes. The issue can affect every Ruby implementation when the vulnerable Addressable behavior is reached.
What can be done if upgrading is not immediately possible?
Avoid normalizing, comparing, or joining untrusted URIs, and restrict the length and structure of attacker-controlled URI input before it reaches those operations. Upgrading to version 2.9.1 fixes the issue.