Denial of Service Vulnerability in Addressable Library for Ruby
CVE-2026-126350

5.9MEDIUM

Key Information:

Vendor

Sporkmonger

Status
Addressable
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126350?

The Addressable library in Ruby contains a vulnerability that allows crafting ambiguous regular expressions through URI template expressions. This can lead to catastrophic backtracking when processing attacker-controlled URIs, which may cause denial of service in both MRI Ruby versions before 3.2 and JRuby. Although Addressable version 2.9.0 attempted to address the issue, it failed to fully remediate it on certain operator-prefixed paths. The issue has been resolved in Addressable version 2.9.1.

Affected Version(s)

addressable >= 2.3.0, < 2.9.1

References

https://github.com/sporkmonger/addressable/security/advis...
x_refsource_CONFIRM
https://github.com/sporkmonger/addressable/issues/364
x_refsource_MISC
https://github.com/sporkmonger/addressable/commit/26d1e9e...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.