CVE-2026-126352: Addressable: Regular Expression Denial of Service in templates with multiple variables
Impact
Within the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking:
1. Expressions with any operator other than + and # (e.g., {/owner,repo,ref}, {.a,b}, {a,b,c}, {;a,b,c}). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables. 2. Expressions with the + or # operators and many variables (e.g., {+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}). A failing match is exponential in the number of variables. 3. Several single-variable expressions next to each other (e.g., {+a}{+b}{+c} or {a}{b}{c}), which are polynomial in the input length.
When Template#match or Template#extract is called with a maliciously crafted URI, this can result in uncontrolled resource consumption, leading to denial of service. A three-variable path template such as http://example.com/repos{/owner,repo,ref} needs about 2 KB of input to occupy a thread for many seconds.
Users of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call Template#expand are unaffected.
Affected Versions
This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.
The vulnerability is exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. The second form, many-variable + and # expressions, is also exploitable on MRI Ruby 3.2, which does not memoize a regular expression that contains possessive quantifiers, and 2.9.0 generates those for these operators. It is also exploitable on TruffleRuby 40.0, whose regular expression engine falls back to backtracking for them. MRI Ruby 3.3 and later are not affected by any form, because they memoize those regular expressions too. TruffleRuby 40.0 is not affected by the other two forms. Earlier TruffleRuby versions were not tested.
This has been confirmed on the following runtimes with Addressable 2.9.0:
| Runtime | Status | |---------|--------| | MRI Ruby 2.7 | Vulnerable | | MRI Ruby 3.1 | Vulnerable | | MRI Ruby 3.2 | Vulnerable | | MRI Ruby 3.3 | Not affected | | MRI Ruby 3.4 | Not affected | | MRI Ruby 4.0 | Not affected | | JRuby 9.4 | Vulnerable | | JRuby 10.1 | Vulnerable | | TruffleRuby 40.0 | Vulnerable |
Workarounds
- Upgrade to MRI Ruby 3.3 or later, if a consuming application does not use JRuby or TruffleRuby. - Avoid matching user-supplied input on unpatched versions of the library against templates with several variables in one expression, or with several expressions next to each other. - Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data.
Credits
Reported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security.
For more information
If there are any questions or comments about this advisory: Open an issue
Other sources
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include multi-variable expressions using operators other than plus and number sign, large plus or number-sign expressions, and adjacent single-variable expressions. Template#match or Template#extract can backtrack polynomially or exponentially on attacker-controlled URIs, causing denial of service on MRI Ruby before 3.2 and JRuby, with the large plus and number-sign form also affecting MRI Ruby 3.2 and TruffleRuby 40.0. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/addressableto a version that resolves this vulnerability.Fixed in 2.9.1 - Upgrade
Upgrade
Addressableto a version that resolves this vulnerability.Fixed in 2.9.1 - Upgrade
Upgrade
MRI Rubyto a version that resolves this vulnerability.Fixed in 3.3 - Compensating control
Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data.
- Compensating control
On unpatched library versions, avoid matching user-supplied input against templates with several variables in one expression, several adjacent expressions, large plus or number-sign expressions, or operators other than + and #.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed only if they use Addressable URI template matching capabilities and call Template#match or Template#extract on attacker-influenced URIs. URI parsing alone is unaffected.
What template patterns create the highest risk?
Risky patterns include expressions with multiple variables using operators other than + or #, such as {/owner,repo,ref}, and + or # expressions containing many variables. Adjacent single-variable expressions, such as {+a}{+b}{+c}, can also cause polynomial-time matching.
What does an attacker need to exploit it?
An attacker needs to cause Template#match or Template#extract to process a specially crafted URI against a vulnerable template. No privileges or user interaction are required.
How severe can the resource impact be?
A three-variable path template such as http://example.com/repos{/owner,repo,ref} can be made to occupy a thread for many seconds with roughly 2 KB of input. This can lead to denial of service through uncontrolled resource consumption.
What can be done before updating?
Avoid matching untrusted URIs with templates containing multiple variables in one expression or several adjacent variable expressions. Where feasible, reject or tightly limit URI input before calling Template#match or Template#extract.