CVE-2026-126352

Received Received - Intake

Addressable Gem URI Template Regex DoS Vulnerability

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include multi-variable expressions using operators other than plus and number sign, large plus or number-sign expressions, and adjacent single-variable expressions. Template#match or Template#extract can backtrack polynomially or exponentially on attacker-controlled URIs, causing denial of service on MRI Ruby before 3.2 and JRuby, with the large plus and number-sign form also affecting MRI Ruby 3.2 and TruffleRuby 40.0. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126352

Affected Vendors & Products

Vendor	Product	Version / Range
ruby	ruby	to 2.9.1 (inc)
ruby	ruby	From 2.3.0 (inc) to 3.2 (exc)
ruby	ruby	to 3.2 (inc)
ruby	ruby	to 40.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Addressable gem in Ruby, specifically versions 2.3.0 to 2.9.1. It involves URI templates with multiple variables or adjacent expressions generating ambiguous regular expressions that can cause excessive backtracking during URI parsing. This leads to denial of service conditions on certain Ruby implementations.

Impact Analysis

An attacker could exploit this by sending specially crafted URIs to applications using vulnerable versions of Addressable. This would consume excessive server resources, potentially crashing the application or making it unresponsive. Systems using MRI Ruby before 3.2, JRuby, or TruffleRuby 40.0 are particularly affected.

Mitigation Strategies

Upgrade the Addressable gem to version 2.9.1 or later to resolve the regex backtracking issue in URI templates.

Hi! I’m here to help you understand CVE-2026-126352. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...