Denial of Service Vulnerability in Addressable by Sporkmonger
CVE-2026-126353

5.9MEDIUM

Key Information:

Vendor

Sporkmonger

Status
Addressable
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126353?

A vulnerability exists in Addressable, an alternative URI implementation for Ruby, where URI template expressions can generate ambiguous regular expressions. This can lead to potential denial of service when processing attacker-controlled URIs, causing thread consumption. This flaw affects versions 2.3.0 through 2.9.1 of Addressable, which are vulnerable to attacks that exploit URI template matching. The issue has been addressed in Addressable version 2.9.1 and beyond.

Affected Version(s)

addressable >= 2.3.0, < 2.9.1

References

https://github.com/sporkmonger/addressable/security/advis...
x_refsource_CONFIRM
https://github.com/sporkmonger/addressable/commit/49aecf9...
x_refsource_MISC
https://github.com/sporkmonger/addressable/releases/tag/a...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.