UBUNTU-CVE-2026-126353: Medium severity ubuntu/ruby-addressable vulnerability
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
addressableto a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An application must use Addressable Template#match or Template#extract on an attacker-controlled URI with a URI template containing several exploded variables. Exploitation relies on expressions that produce ambiguous regular expressions, allowing polynomially many ways to divide URI members among variables.
Which Ruby runtimes and template forms are affected?
The issue affects MRI Ruby before 3.2, JRuby, and TruffleRuby 40.0. On MRI Ruby 3.2, it affects plus or number-sign expressions; MRI Ruby 3.3 and later are unaffected.
Are all Addressable URI operations vulnerable?
No. URI parsing and Template#expand are unaffected. The affected operations are Template#match and Template#extract.
What is the available remediation?
Upgrade ruby-addressable to version 2.9.1, which fixes the issue. If upgrading cannot happen immediately, avoid applying Template#match or Template#extract to attacker-controlled URIs where templates contain several exploded variables.