CVE-2026-126350: Addressable: Regular Expression Denial of Service in templates with certain exploded expressions
Impact
Within the URI template implementation in Addressable, templates using the (explode) modifier with the /, ., ;, ? or & operators (e.g., {/segments}, {.ext}, {;params}, {?query}) generate regular expressions vulnerable to catastrophic backtracking. When Template#match or Template#extract is called with a maliciously crafted URI that starts with the operator's leading character, matching takes exponential time, leading to uncontrolled resource consumption and denial of service. An input under 60 bytes is enough to occupy a thread for minutes.
GHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as fully remediated in 2.9.0. The 2.9.0 fix only made the joiner between exploded members mandatory for templates without an operator, and its regression specs used inputs that never start with the operator's leading character, so the vulnerable part of the expression was never reached. This issue was originally reported in #364 by @ebenoist in 2019 but insufficiently investigated.
Users of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call Template#expand are unaffected.
Affected Versions
This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.
The vulnerability is only exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. MRI Ruby 3.2 and later are not affected: their regular expression engine memoizes backtracking, so these patterns still match in linear time. TruffleRuby 40.0 is not affected either. Earlier TruffleRuby versions were not tested.
This has been confirmed on the following runtimes with Addressable 2.9.0:
| Runtime | Status | |---------|--------| | MRI Ruby 2.7 | Vulnerable | | MRI Ruby 3.1 | Vulnerable | | MRI Ruby 3.2 | Not affected | | MRI Ruby 3.3 | Not affected | | MRI Ruby 3.4 | Not affected | | MRI Ruby 4.0 | Not affected | | JRuby 9.4 | Vulnerable | | TruffleRuby 40.0 | Not affected |
Workarounds
- Upgrade to MRI Ruby 3.2 or later, if the consuming application does not use JRuby. - Avoid matching user-supplied input on unpatched versions of the library against templates that use the modifier with the /, ., ;, ? or & operators. - Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data.
Credits
Reported independently by @ebenoist, @andrewstellman, and then @halogenandtoast.
For more information
If there are any questions or comments about this advisory: Open an issue
Other sources
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/addressableto a version that resolves this vulnerability.Fixed in 2.9.1 - Upgrade
Upgrade
Addressableto a version that resolves this vulnerability.Fixed in 2.9.1 - Upgrade
Upgrade
MRI Rubyto a version that resolves this vulnerability.Fixed in 3.2 - Compensating control
Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data.
- Compensating control
On unpatched versions of Addressable, avoid matching user-supplied input against templates that use the * modifier with the /, ., ;, ? or & operators.
Event History
Frequently Asked Questions
Which uses of Addressable are exposed to this denial-of-service issue?
Applications are exposed when they use URI templates with the explode modifier and one of the /, ., ;, ? or & operators, then call Template#match or Template#extract on attacker-controlled URIs. URI parsing alone and applications that only call Template#expand are unaffected.
What does an attacker need to trigger the issue?
An attacker needs to supply a maliciously crafted URI to matching or extraction logic. The URI must start with the leading character of the template operator; inputs under 60 bytes can occupy a thread for minutes.
Are templates without an operator protected by the earlier 2.9.0 remediation?
The earlier 2.9.0 change made the joiner between exploded members mandatory only for templates without an operator. It did not remediate the vulnerable regular-expression behavior for exploded expressions using the affected operators.