CVE-2026-126350

Received Received - Intake

ReDoS in Addressable Ruby Gem via URI Template

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126350

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Addressable library in Ruby, specifically versions 2.3.0 to 2.9.1. It involves URI template expressions using the explode modifier with certain operators (slash, dot, semicolon, question-mark, or ampersand). These expressions generate ambiguous regular expressions that can cause catastrophic backtracking when processing attacker-controlled URIs starting with the operator's leading character. This leads to denial of service conditions on MRI Ruby before 3.2 and JRuby.

Impact Analysis

If you use the Addressable library in your Ruby application, an attacker could exploit this vulnerability to cause a denial of service by sending specially crafted URIs. This could crash your application or consume excessive system resources, leading to degraded performance or downtime.

Mitigation Strategies

Update the Addressable gem to version 2.9.1 or later to address the regular expression denial of service vulnerability in URI template processing.

Hi! I’m here to help you understand CVE-2026-126350. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...