UBUNTU-CVE-2026-126350: Medium severity ubuntu/ruby-addressable vulnerability
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Addressableto a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed to denial of service?
Deployments using Addressable versions 2.3.0 through 2.9.1 that call Template#match or Template#extract on attacker-controlled URIs are exposed, specifically on MRI Ruby before 3.2 and on JRuby. URI parsing and Template#expand are not affected.
What input is required to trigger the issue?
An attacker must supply a URI that begins with the leading character of a URI template operator and reaches a template expression using the explode modifier with a slash, dot, semicolon, question-mark, or ampersand operator. The ambiguous regular expression can then cause catastrophic backtracking.
Are applications using Addressable 2.9.0 protected?
No. Version 2.9.0 incompletely remediated an earlier template issue because its tests did not cover these operator-prefixed paths; the issue is fixed in version 2.9.1.
What can be done if upgrading is not immediately possible?
Avoid passing attacker-controlled URIs to Template#match or Template#extract when templates use the explode modifier with the affected operators. URI parsing and Template#expand do not trigger this issue.