Denial of Service Vulnerability in Ruby's Addressable Library

CVE-2026-126352

What is CVE-2026-126352?

The Addressable library in Ruby, which provides an alternative implementation of URI parsing, has a vulnerability affecting versions 2.3.0 through 2.9.1. This vulnerability occurs when URI templates with multiple variables lead to the generation of ambiguous regular expressions. Specifically, it impacts forms involving multi-variable expressions and adjacent single-variable expressions, which can be exploited by crafting attacker-controlled URIs. This may lead to significant backtracking, resulting in denial of service. The issue has been resolved in version 2.9.1.

References