ADDRESSABLE · CVE-2026-126351 · Package
FIX → 2.9.1
Addressable's path normalization removes dot segments one pass at a time, so cost grows with the square of the path length. A remote attacker who gets a crafted URI from user input into normalize, ==, or join can tie up CPU for seconds per call.
first public Oct 30, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that take URIs from untrusted sources (request parameters, request bodies, headers such as Location, or stored data) and then normalize, compare or join them with Addressable. Code that only calls URI.parse, or never normalizes, compares or joins untrusted URIs, is not exposed.
Not affected if no-untrusted-uris, patched-2.9.1, uri-parse-only
Who cares addressable, ruby, rubygems, web-apps
gem list addressable or bundle exec gem list addressable, or look at Gemfile.lock for addressable.normalize, normalized_path, ==, === or join on URIs built from request input, headers or stored data.Addressable::URI.normalize_path takes time quadratic in the number of nested dot segments in a path (e.g., "/" + "a/" * n + "../" * n, which for n = 3 is /a/a/a/../../../), because it removes one dot segment per pass over the whole path. URI#normalize, URI#normalized_path, URI#==, URI#=== and URI#join all call it. Normalizing, comparing or joining a URI taken from user input can result in uncontrolled resource consumption, leading to denial of service. On 2.9.0, normalizing a 34 KB path takes about 3.5 seconds on MRI Ruby 4.0, and the cost grows with the square of the path length.
This affects every Ruby implementation, including MRI Ruby 3.2 and later. URI.parse by itself is unaffected, as is code that never normalizes, compares, or joins URIs from untrusted sources.
This vulnerability affects all versions of Addressable prior to 2.9.1. It is fixed in 2.9.1.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 2.9.1
addressable 2.9.1 (affected: all versions before 2.9.1)normalize, == or join on them. Web servers often limit request lines to about 8 KB, which keeps the cost to about 150 milliseconds per call on typical hardware, but URIs from other sources (request bodies, headers such as Location, stored data) may not be limited.Reported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security, who also suggested the single-pass approach used in the fix.
If there are any questions or comments about this advisory:
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.