{"id":"CVE-2026-126350","kind":"vulnerability","aliases":["CVE-2026-126350","GHSA-j82w-28jv-3pmj"],"related":[],"title":"Addressable: Regular Expression Denial of Service in templates with certain exploded expressions","description":"### Impact\n\nWithin the URI template implementation in Addressable, templates using the `*` (explode) modifier with the `/`, `.`, `;`, `?` or `&` operators (e.g., `{/segments*}`, `{.ext*}`, `{;params*}`, `{?query*}`) generate regular expressions vulnerable to catastrophic backtracking. When `Template#match` or `Template#extract` is called with a maliciously crafted URI that starts with the operator's leading character, matching takes exponential time, leading to uncontrolled resource consumption and denial of service. An input under 60 bytes is enough to occupy a thread for minutes.\n\nGHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as fully remediated in 2.9.0. The 2.9.0 fix only made the joiner between exploded members mandatory for templates without an operator, and its regression specs used inputs that never start with the operator's leading character, so the vulnerable part of the expression was never reached. This issue was originally reported in #364 by @ebenoist in 2019 but insufficiently investigated.\n\nUsers of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.\n\nThe vulnerability is only exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. MRI Ruby 3.2 and later are not affected: their regular expression engine memoizes backtracking, so these patterns still match in linear time. TruffleRuby 40.0 is not affected either. Earlier TruffleRuby versions were not tested.\n\nThis has been confirmed on the following runtimes with Addressable 2.9.0:\n\n| Runtime | Status |\n|---------|--------|\n| MRI Ruby 2.7 | Vulnerable |\n| MRI Ruby 3.1 | Vulnerable |\n| MRI Ruby 3.2 | Not affected |\n| MRI Ruby 3.3 | Not affected |\n| MRI Ruby 3.4 | Not affected |\n| MRI Ruby 4.0 | Not affected |\n| JRuby 9.4 | Vulnerable |\n| TruffleRuby 40.0 | Not affected |\n\n### Workarounds\n\n- Upgrade to MRI Ruby 3.2 or later, if the consuming application does not use JRuby.\n- Avoid matching user-supplied input on unpatched versions of the library against templates that use the `*` modifier with the `/`, `.`, `;`, `?` or `&` operators.\n- Apply a short timeout around any call to `Template#match` or `Template#extract` that processes user-supplied data.\n\n### Credits\n\nReported independently by @ebenoist, @andrewstellman, and then @halogenandtoast.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","summary":"Addressable's URI template matching builds regular expressions that backtrack catastrophically when a crafted URI starts with the operator character of an exploded expression. An input under 60 bytes can tie up a thread for minutes, which is a denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"addressable","fixed":["2.9.1"],"affected":">= 2.3.0, < 2.9.1","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["addressable","cwe-1333","package","ruby","rubygems"],"not_affected_if":["ruby-3.2-or-later","template-expand-only","truffleruby","uri-parsing-only"],"how_to_check":"- Check the installed version with `bundle exec gem list addressable` or inspect `Gemfile.lock` for `addressable`, looking for a version at or above `2.3.2` and below `2.9.1`.\n- Check the Ruby runtime with `ruby -v`; the flaw applies to MRI Ruby below `3.2` and to JRuby, not to MRI `3.2+` or TruffleRuby 40.0.\n- Search the code for `Template#match` or `Template#extract` called on user-supplied input with templates using `*` with `/`, `.`, `;`, `?` or `&` operators.","fix":"- `addressable` `2.9.1`","status":"open","published_at":"2026-11-12T22:19:20+00:00","first_seen_at":"2026-11-12T22:31:51+00:00","triaged_at":"2026-11-12T22:32:15+00:00","updated_at":"2026-11-12T22:40:38+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T22:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- `addressable` `2.9.1`","reach":"internet","title":"Addressable: URI template matching can hang on crafted input, causing denial of service","impact":"low","summary":"Addressable's URI template matching builds regular expressions that backtrack catastrophically when a crafted URI starts with the operator character of an exploded expression. An input under 60 bytes can tie up a thread for minutes, which is a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","rubygems","addressable"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-sent input stalls a worker thread for minutes, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed version with `bundle exec gem list addressable` or inspect `Gemfile.lock` for `addressable`, looking for a version at or above `2.3.2` and below `2.9.1`.\n- Check the Ruby runtime with `ruby -v`; the flaw applies to MRI Ruby below `3.2` and to JRuby, not to MRI `3.2+` or TruffleRuby 40.0.\n- Search the code for `Template#match` or `Template#extract` called on user-supplied input with templates using `*` with `/`, `.`, `;`, `?` or `&` operators.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["uri-parsing-only","template-expand-only","ruby-3.2-or-later","truffleruby"],"who_is_affected":"Applications that use Addressable's URI template match or extract methods on user-supplied URIs, with templates that use the explode modifier and the /, ., ;, ?, or & operators, running on MRI Ruby below 3.2 or on JRuby. Applications that only parse URIs or only call Template#expand are unaffected, and so are those on MRI 3.2 or later or TruffleRuby 40.0.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000924,"input_tokens":5656,"output_tokens":716,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126350':15A,23A '-1333':27B '-2026':14A,22A,155C '-35611':156C '/segments':91C '/sporkmonger/addressable/issues)':457C '2.3.0':251C,253C '2.3.1':255C '2.3.2':263C '2.7':340C '2.9.0':164C,166C,265C,335C '2.9.1':270C '2019':216C '24p4':153C '28jv':19A '3.1':344C '3.2':288C,293C,348C,378C '3.3':353C '3.4':358C '364':212C '3pmj':20A '4.0':363C '40.0':314C,370C '60':58B,139C '9.4':367C 'address':1A,25B,31B,80C,227C,250C,334C 'addressable':24A 'advisori':451C 'affect':245C,249C,298C,317C,350C,355C,360C,365C,372C 'andrewstellman':435C 'appli':411C 'applic':384C 'around':415C 'avoid':389C 'backtrack':40B,101C,283C,304C 'build':36B 'byte':59B,140C 'call':109C,240C,417C 'capabl':225C,234C 'catastroph':41B,100C 'certain':10A 'charact':50B,122C,195C 'comment':448C 'confirm':328C 'consum':383C 'consumpt':131C 'craft':44B,113C 'credit':430C 'cve':13A,21A,154C 'cwe':26B 'data':429C 'denial':4A,70B,133C 'e.g':90C 'earlier':319C 'earliest':259C 'ebenoist':214C,434C 'either':318C 'engin':282C,302C 'enough':142C 'expand':242C 'explod':11A,53B,84C,173C 'exploit':275C 'exponenti':125C 'express':3A,12A,38B,54B,97C,202C,281C,301C 'ext':92C 'extract':107C,423C 'fix':167C,268C 'follow':331C 'fulli':161C 'generat':95C 'ghsa':17A,150C 'ghsa-h27x-rffw-24p4':149C 'ghsa-j82w-28jv-3pmj':16A 'github.com':456C 'github.com/sporkmonger/addressable/issues)':455C 'h27x':151C 'halogenandtoast':438C 'impact':73C 'implement':78C,278C 'includ':264C 'independ':432C 'inform':441C 'input':56B,137C,186C,394C 'instal':260C 'insuffici':218C 'investig':219C 'issu':207C,454C 'j82w':18A 'joiner':171C 'jrubi':290C,366C,388C 'later':295C,380C 'lead':121C,127C,194C 'librari':400C 'linear':311C 'made':169C 'malici':112C 'mandatori':175C 'match':35B,104C,123C,233C,309C,390C,420C 'member':174C 'memoiz':285C,303C 'minut':66B,148C 'modifi':85C,406C 'mri':286C,291C,338C,342C,346C,351C,356C,361C,376C 'never':188C,204C 'note':252C 'occupi':144C 'open':452C 'oper':49B,89C,119C,180C,192C,410C 'origin':209C 'packag':28B 'param':93C 'pars':224C 'part':199C 'pattern':159C,307C 'process':425C 'queri':94C 'question':446C 'reach':205C 'regress':183C 'regular':2A,37B,96C,280C,300C 'releas':261C 'remedi':162C 'report':157C,210C,431C 'resourc':130C 'rffw':152C 'rubi':29B,277C,287C,292C,339C,343C,347C,352C,357C,362C,377C 'rubygem':30B 'runtim':332C,336C 'servic':6A,72B,135C 'short':413C 'spec':184C 'start':46B,116C,189C 'status':337C 'still':308C 'suppli':393C,428C 'take':124C 'templat':8A,34B,77C,81C,103C,106C,177C,232C,241C,402C,419C,422C 'test':324C 'thread':64B,146C 'tie':61B 'time':126C,312C 'timeout':414C 'trufflerubi':313C,320C,369C 'unaffect':236C,244C 'uncontrol':129C 'unpatch':396C 'upgrad':374C 'uri':33B,45B,76C,114C,223C,231C 'use':82C,185C,387C,404C 'user':220C,237C,392C,427C 'user-suppli':391C,426C 'version':246C,321C,397C 'vulner':98C,198C,248C,272C,341C,345C,368C 'whose':279C 'within':74C 'without':178C,284C 'workaround':373C 'yank':257C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Addressable's URI template match or extract methods on user-supplied URIs, with templates that use the explode modifier and the /, ., ;, ?, or & operators, running on MRI Ruby below 3.2 or on JRuby. Applications that only parse URIs or only call Template#expand are unaffected, and so are those on MRI 3.2 or later or TruffleRuby 40.0.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["addressable"],"ptokens":["addressable"],"labels":["addressable","cwe1333","medium","package","ruby","rubygems"],"campaign_type":null,"search_a":"'-126350':15A,23A '-2026':14A,22A '28jv':19A '3pmj':20A 'address':1A 'addressable':24A 'certain':10A 'cve':13A,21A 'denial':4A 'explod':11A 'express':3A,12A 'ghsa':17A 'ghsa-j82w-28jv-3pmj':16A 'j82w':18A 'regular':2A 'servic':6A 'templat':8A","search_b":"'-1333':27B '60':58B 'address':25B,31B 'backtrack':40B 'build':36B 'byte':59B 'catastroph':41B 'charact':50B 'craft':44B 'cwe':26B 'denial':70B 'explod':53B 'express':38B,54B 'input':56B 'match':35B 'minut':66B 'oper':49B 'packag':28B 'regular':37B 'rubi':29B 'rubygem':30B 'servic':72B 'start':46B 'templat':34B 'thread':64B 'tie':61B 'uri':33B,45B","search_c":"'-2026':155C '-35611':156C '/segments':91C '/sporkmonger/addressable/issues)':457C '2.3.0':251C,253C '2.3.1':255C '2.3.2':263C '2.7':340C '2.9.0':164C,166C,265C,335C '2.9.1':270C '2019':216C '24p4':153C '3.1':344C '3.2':288C,293C,348C,378C '3.3':353C '3.4':358C '364':212C '4.0':363C '40.0':314C,370C '60':139C '9.4':367C 'address':80C,227C,250C,334C 'advisori':451C 'affect':245C,249C,298C,317C,350C,355C,360C,365C,372C 'andrewstellman':435C 'appli':411C 'applic':384C 'around':415C 'avoid':389C 'backtrack':101C,283C,304C 'byte':140C 'call':109C,240C,417C 'capabl':225C,234C 'catastroph':100C 'charact':122C,195C 'comment':448C 'confirm':328C 'consum':383C 'consumpt':131C 'craft':113C 'credit':430C 'cve':154C 'data':429C 'denial':133C 'e.g':90C 'earlier':319C 'earliest':259C 'ebenoist':214C,434C 'either':318C 'engin':282C,302C 'enough':142C 'expand':242C 'explod':84C,173C 'exploit':275C 'exponenti':125C 'express':97C,202C,281C,301C 'ext':92C 'extract':107C,423C 'fix':167C,268C 'follow':331C 'fulli':161C 'generat':95C 'ghsa':150C 'ghsa-h27x-rffw-24p4':149C 'github.com':456C 'github.com/sporkmonger/addressable/issues)':455C 'h27x':151C 'halogenandtoast':438C 'impact':73C 'implement':78C,278C 'includ':264C 'independ':432C 'inform':441C 'input':137C,186C,394C 'instal':260C 'insuffici':218C 'investig':219C 'issu':207C,454C 'joiner':171C 'jrubi':290C,366C,388C 'later':295C,380C 'lead':121C,127C,194C 'librari':400C 'linear':311C 'made':169C 'malici':112C 'mandatori':175C 'match':104C,123C,233C,309C,390C,420C 'member':174C 'memoiz':285C,303C 'minut':148C 'modifi':85C,406C 'mri':286C,291C,338C,342C,346C,351C,356C,361C,376C 'never':188C,204C 'note':252C 'occupi':144C 'open':452C 'oper':89C,119C,180C,192C,410C 'origin':209C 'param':93C 'pars':224C 'part':199C 'pattern':159C,307C 'process':425C 'queri':94C 'question':446C 'reach':205C 'regress':183C 'regular':96C,280C,300C 'releas':261C 'remedi':162C 'report':157C,210C,431C 'resourc':130C 'rffw':152C 'rubi':277C,287C,292C,339C,343C,347C,352C,357C,362C,377C 'runtim':332C,336C 'servic':135C 'short':413C 'spec':184C 'start':116C,189C 'status':337C 'still':308C 'suppli':393C,428C 'take':124C 'templat':77C,81C,103C,106C,177C,232C,241C,402C,419C,422C 'test':324C 'thread':146C 'time':126C,312C 'timeout':414C 'trufflerubi':313C,320C,369C 'unaffect':236C,244C 'uncontrol':129C 'unpatch':396C 'upgrad':374C 'uri':76C,114C,223C,231C 'use':82C,185C,387C,404C 'user':220C,237C,392C,427C 'user-suppli':391C,426C 'version':246C,321C,397C 'vulner':98C,198C,248C,272C,341C,345C,368C 'whose':279C 'within':74C 'without':178C,284C 'workaround':373C 'yank':257C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-30T08:14:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j82w-28jv-3pmj","url":"https://github.com/advisories/GHSA-j82w-28jv-3pmj","severity":"medium","published_at":"2026-11-12T22:30:37+00:00","modified_at":"2026-11-12T22:30:39+00:00","first_seen_at":"2026-11-12T22:31:51+00:00","fetched_at":"2026-11-12T22:39:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-126350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126350","severity":null,"published_at":"2026-11-12T22:19:20+00:00","modified_at":"2026-11-12T22:19:20+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null}],"documents":[{"id":139734,"url":"https://api.github.com/repos/sporkmonger/addressable/security-advisories/GHSA-j82w-28jv-3pmj","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":139735,"url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-10-30T08:14:07+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":139736,"url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":139737,"url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}