URI Normalization Flaw in Addressable Affects Ruby Environments

CVE-2026-126354

What is CVE-2026-126354?

The vulnerability in Addressable's URI normalization allows applications to incorrectly authorize paths when using Addressable::URI.normalize_path. This occurs due to the library resolving paths with leading parent segments differently than expected, possibly leading to unauthorized file access. An application relying on this behavior can expose sensitive data if the original URI is sent to another resolver, as it may not enforce the intended authorization checks. Version 2.9.1 includes a fix for this vulnerability, ensuring compliance with RFC 3986 standards.

References