CVE-2026-126353: Addressable: Regular Expression Denial of Service in Addressable templates with several exploded variables
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Addressableto a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications using Addressable versions 2.3.0 through before 2.9.1 are exposed when they use Template#match or Template#extract on attacker-controlled URIs with template expressions containing several exploded variables. URI parsing and Template#expand are not affected.
Which Ruby runtimes and template expression types are affected?
MRI Ruby before 3.2, JRuby, and TruffleRuby 40.0 are affected. On MRI Ruby 3.2, the issue is limited to plus or number-sign expressions; MRI Ruby 3.3 and later are unaffected.
What must an attacker provide to trigger the issue?
An attacker must be able to supply a URI that the application processes through Template#match or Template#extract. Exploitation depends on a vulnerable template containing several exploded variables and can consume a thread through polynomially expensive regular-expression matching.
What version fixes the issue?
Addressable 2.9.1 fixes the issue.