Addressable Library Vulnerability in Ruby's URI Implementation

CVE-2026-126351

What is CVE-2026-126351?

The Addressable library in Ruby, an alternative way to handle URIs, contains a vulnerability in its normalization processes prior to version 2.9.1. The method Addressable::URI.normalize_path inefficiently handles nested dot segments, which can lead to excessive resource consumption when processing long, attacker-controlled URIs. This behavior can exhaust the worker thread, resulting in service interruptions. However, URIs that do not undergo normalization, comparisons, or joining remain unaffected. The issue has been resolved in version 2.9.1.

References