{"id":"CVE-2026-126352","kind":"vulnerability","aliases":["CVE-2026-126352","GHSA-9f42-57jx-vpp3"],"related":[],"title":"Addressable: Regular Expression Denial of Service in templates with multiple variables","description":"### Impact\n\nWithin the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking:\n\n1. Expressions with any operator other than `+` and `#` (e.g., `{/owner,repo,ref}`, `{.a,b}`, `{a,b,c}`, `{;a,b,c}`). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables.\n2. Expressions with the `+` or `#` operators and many variables (e.g., `{+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}`). A failing match is exponential in the number of variables.\n3. Several single-variable expressions next to each other (e.g., `{+a}{+b}{+c}` or `{a}{b}{c}`), which are polynomial in the input length.\n\nWhen `Template#match` or `Template#extract` is called with a maliciously crafted URI, this can result in uncontrolled resource consumption, leading to denial of service. A three-variable path template such as `http://example.com/repos{/owner,repo,ref}` needs about 2 KB of input to occupy a thread for many seconds.\n\nUsers of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.\n\nThe vulnerability is exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. The second form, many-variable `+` and `#` expressions, is also exploitable on MRI Ruby 3.2, which does not memoize a regular expression that contains possessive quantifiers, and 2.9.0 generates those for these operators. It is also exploitable on TruffleRuby 40.0, whose regular expression engine falls back to backtracking for them. MRI Ruby 3.3 and later are not affected by any form, because they memoize those regular expressions too. TruffleRuby 40.0 is not affected by the other two forms. Earlier TruffleRuby versions were not tested.\n\nThis has been confirmed on the following runtimes with Addressable 2.9.0:\n\n| Runtime | Status |\n|---------|--------|\n| MRI Ruby 2.7 | Vulnerable |\n| MRI Ruby 3.1 | Vulnerable |\n| MRI Ruby 3.2 | Vulnerable |\n| MRI Ruby 3.3 | Not affected |\n| MRI Ruby 3.4 | Not affected |\n| MRI Ruby 4.0 | Not affected |\n| JRuby 9.4 | Vulnerable |\n| JRuby 10.1 | Vulnerable |\n| TruffleRuby 40.0 | Vulnerable |\n\n### Workarounds\n\n- Upgrade to MRI Ruby 3.3 or later, if a consuming application does not use JRuby or TruffleRuby.\n- Avoid matching user-supplied input on unpatched versions of the library against templates with several variables in one expression, or with several expressions next to each other.\n- Apply a short timeout around any call to `Template#match` or `Template#extract` that processes user-supplied data.\n\n### Credits\n\nReported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","summary":"Addressable's URI template matcher builds regular expressions that backtrack excessively when a template has several variables in one expression. A crafted URI passed to Template#match or Template#extract can tie up a thread for seconds, causing denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"addressable","fixed":["2.9.1"],"affected":">= 2.3.0, < 2.9.1","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["addressable","cwe-1333","package","rails","ruby","rubygems"],"not_affected_if":["expand-only","mri-ruby-3.3-or-later","no-user-supplied-uris","uri-parsing-only"],"how_to_check":"- Check the locked version in Gemfile.lock for `addressable` and see whether it is at least `2.9.1`.\n- Run `ruby -v` to confirm the runtime; MRI Ruby 3.3 or later is not affected by any form, per the advisory.\n- Search the codebase for `Template#match` or `Template#extract` calls that process user-supplied URIs.","fix":null,"status":"open","published_at":"2026-11-12T22:19:20+00:00","first_seen_at":"2026-11-12T22:31:51+00:00","triaged_at":"2026-11-12T22:32:15+00:00","updated_at":"2026-11-12T22:40:38+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-12T22:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- `addressable` gem: upgrade to `2.9.1`.","reach":"internet","title":"Addressable: URI template matching lets crafted input stall Ruby threads","impact":"low","summary":"Addressable's URI template matcher builds regular expressions that backtrack excessively when a template has several variables in one expression. A crafted URI passed to Template#match or Template#extract can tie up a thread for seconds, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","rubygems","addressable","rails"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"Crafted input exhausts CPU and stalls request threads, causing denial of service.","analyst_note":"","how_to_check":"- Check the locked version in Gemfile.lock for `addressable` and see whether it is at least `2.9.1`.\n- Run `ruby -v` to confirm the runtime; MRI Ruby 3.3 or later is not affected by any form, per the advisory.\n- Search the codebase for `Template#match` or `Template#extract` calls that process user-supplied URIs.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["expand-only","uri-parsing-only","mri-ruby-3.3-or-later","no-user-supplied-uris"],"who_is_affected":"Applications that call Template#match or Template#extract from the addressable gem on user-supplied URIs, running on affected versions (2.3.2 through 2.9.0) under MRI Ruby below 3.3, JRuby, or TruffleRuby. The advisory states that code using only URI parsing or Template#expand is unaffected, and MRI Ruby 3.3 and later are not affected by any form.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.0009,"input_tokens":5819,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126352':14A,22A '-1333':26B '-2026':13A,21A '/owner':104C,233C '/repos':232C '/sporkmonger/addressable/issues)':545C '1':95C '10.1':447C '2':142C,238C '2.3.0':280C,282C '2.3.1':284C '2.3.2':292C '2.7':418C '2.9.0':294C,346C,413C '2.9.1':299C '3':172C '3.1':422C '3.2':316C,333C,426C '3.3':371C,430C,457C '3.4':435C '4.0':440C '40.0':358C,388C,450C '57jx':18A '9.4':444C '9f42':17A 'address':1A,24B,31B,79C,256C,279C,412C 'addressable':23A 'advisori':539C 'affect':274C,278C,376C,391C,432C,437C,442C 'also':328C,354C 'among':131C 'appli':498C 'applic':463C 'around':502C 'avoid':470C 'b':108C,110C,113C,184C,188C 'back':364C 'backtrack':40B,94C,311C,366C 'build':36B 'c':111C,114C,185C,189C 'call':204C,269C,504C 'capabl':254C,263C 'caus':68B 'central':524C 'charact':127C 'comment':536C 'confirm':406C 'consum':462C 'consumpt':216C 'contain':342C 'craft':52B,208C 'credit':517C 'cve':12A,20A 'cwe':25B 'data':516C 'denial':4A,69B,219C 'divid':130C 'e.g':103C,151C,182C 'earlier':397C 'earliest':288C 'engin':310C,362C 'example.com':231C 'example.com/repos':230C 'excess':41B,93C 'expand':271C 'exploit':303C,329C,355C 'exponenti':166C 'express':3A,38B,50B,87C,90C,96C,143C,177C,309C,326C,340C,361C,385C,489C,493C 'extract':60B,202C,510C 'fail':163C 'fall':363C 'fix':297C 'follow':409C 'form':321C,379C,396C 'gem':525C 'generat':88C,347C 'ghsa':16A 'ghsa-9f42-57jx-vpp3':15A 'github.com':544C 'github.com/sporkmonger/addressable/issues)':543C 'halogenandtoast':522C 'impact':72C 'implement':77C,306C 'includ':293C 'inform':529C 'input':195C,241C,475C 'instal':289C 'issu':542C 'join':118C 'jrubi':318C,443C,446C,467C 'k':137C,140C 'kb':239C 'later':373C,459C 'lead':217C 'length':196C 'librari':481C 'malici':207C 'mani':149C,247C,323C 'many-vari':322C 'match':57B,164C,199C,262C,471C,507C 'matcher':35B 'matthew':520C 'memoiz':313C,337C,382C 'mongeau':521C 'mri':314C,331C,369C,416C,420C,424C,428C,433C,438C,455C 'multipl':10A 'n':136C 'need':236C 'next':178C,494C 'note':281C 'number':169C 'o':135C 'occupi':243C 'one':49B,86C,488C 'open':540C 'oper':99C,147C,351C 'option':121C 'packag':27B 'pars':253C 'pass':54B 'path':226C 'polynomi':192C 'possess':343C 'process':512C 'put':82C 'quantifi':344C 'question':534C 'rail':28B 'ref':106C,235C 'regular':2A,37B,89C,308C,339C,360C,384C 'releas':290C 'repo':105C,234C 'report':518C 'resourc':215C 'result':212C 'rubi':29B,305C,315C,332C,370C,417C,421C,425C,429C,434C,439C,456C,523C 'rubygem':30B 'run':125C 'runtim':410C,414C 'second':67B,248C,320C 'secur':526C 'separ':122C 'servic':6A,71B,221C 'sever':46B,83C,173C,485C,492C 'short':500C 'singl':175C 'single-vari':174C 'status':415C 'suppli':474C,515C 'templat':8A,34B,44B,56B,59B,76C,80C,198C,201C,227C,261C,270C,483C,506C,509C 'test':402C 'thread':65B,245C 'three':224C 'three-vari':223C 'tie':62B 'timeout':501C 'trufflerubi':357C,387C,398C,449C,469C 'two':395C 'unaffect':265C,273C 'uncontrol':214C 'unpatch':477C 'upgrad':453C 'uri':33B,53B,75C,209C,252C,260C 'use':466C 'user':249C,266C,473C,514C 'user-suppli':472C,513C 'v1':152C 'v10':161C 'v2':153C 'v3':154C 'v4':155C 'v5':156C 'v6':157C 'v7':158C 'v8':159C 'v9':160C 'valu':116C 'variabl':11A,47B,84C,133C,141C,150C,171C,176C,225C,324C,486C 'version':275C,399C,478C 'vpp3':19A 'vulner':91C,277C,301C,419C,423C,427C,445C,448C,451C 'way':138C 'whose':307C,359C 'within':73C 'without':312C 'workaround':452C 'yank':286C","nicknames":[],"mitigations":[],"who_affected":"Applications that call Template#match or Template#extract from the addressable gem on user-supplied URIs, running on affected versions (2.3.2 through 2.9.0) under MRI Ruby below 3.3, JRuby, or TruffleRuby. The advisory states that code using only URI parsing or Template#expand is unaffected, and MRI Ruby 3.3 and later are not affected by any form.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["addressable"],"ptokens":["addressable"],"labels":["addressable","cwe1333","medium","package","rails","ruby","rubygems"],"campaign_type":null,"search_a":"'-126352':14A,22A '-2026':13A,21A '57jx':18A '9f42':17A 'address':1A 'addressable':23A 'cve':12A,20A 'denial':4A 'express':3A 'ghsa':16A 'ghsa-9f42-57jx-vpp3':15A 'multipl':10A 'regular':2A 'servic':6A 'templat':8A 'variabl':11A 'vpp3':19A","search_b":"'-1333':26B 'address':24B,31B 'backtrack':40B 'build':36B 'caus':68B 'craft':52B 'cwe':25B 'denial':69B 'excess':41B 'express':38B,50B 'extract':60B 'match':57B 'matcher':35B 'one':49B 'packag':27B 'pass':54B 'rail':28B 'regular':37B 'rubi':29B 'rubygem':30B 'second':67B 'servic':71B 'sever':46B 'templat':34B,44B,56B,59B 'thread':65B 'tie':62B 'uri':33B,53B 'variabl':47B","search_c":"'/owner':104C,233C '/repos':232C '/sporkmonger/addressable/issues)':545C '1':95C '10.1':447C '2':142C,238C '2.3.0':280C,282C '2.3.1':284C '2.3.2':292C '2.7':418C '2.9.0':294C,346C,413C '2.9.1':299C '3':172C '3.1':422C '3.2':316C,333C,426C '3.3':371C,430C,457C '3.4':435C '4.0':440C '40.0':358C,388C,450C '9.4':444C 'address':79C,256C,279C,412C 'advisori':539C 'affect':274C,278C,376C,391C,432C,437C,442C 'also':328C,354C 'among':131C 'appli':498C 'applic':463C 'around':502C 'avoid':470C 'b':108C,110C,113C,184C,188C 'back':364C 'backtrack':94C,311C,366C 'c':111C,114C,185C,189C 'call':204C,269C,504C 'capabl':254C,263C 'central':524C 'charact':127C 'comment':536C 'confirm':406C 'consum':462C 'consumpt':216C 'contain':342C 'craft':208C 'credit':517C 'data':516C 'denial':219C 'divid':130C 'e.g':103C,151C,182C 'earlier':397C 'earliest':288C 'engin':310C,362C 'example.com':231C 'example.com/repos':230C 'excess':93C 'expand':271C 'exploit':303C,329C,355C 'exponenti':166C 'express':87C,90C,96C,143C,177C,309C,326C,340C,361C,385C,489C,493C 'extract':202C,510C 'fail':163C 'fall':363C 'fix':297C 'follow':409C 'form':321C,379C,396C 'gem':525C 'generat':88C,347C 'github.com':544C 'github.com/sporkmonger/addressable/issues)':543C 'halogenandtoast':522C 'impact':72C 'implement':77C,306C 'includ':293C 'inform':529C 'input':195C,241C,475C 'instal':289C 'issu':542C 'join':118C 'jrubi':318C,443C,446C,467C 'k':137C,140C 'kb':239C 'later':373C,459C 'lead':217C 'length':196C 'librari':481C 'malici':207C 'mani':149C,247C,323C 'many-vari':322C 'match':164C,199C,262C,471C,507C 'matthew':520C 'memoiz':313C,337C,382C 'mongeau':521C 'mri':314C,331C,369C,416C,420C,424C,428C,433C,438C,455C 'n':136C 'need':236C 'next':178C,494C 'note':281C 'number':169C 'o':135C 'occupi':243C 'one':86C,488C 'open':540C 'oper':99C,147C,351C 'option':121C 'pars':253C 'path':226C 'polynomi':192C 'possess':343C 'process':512C 'put':82C 'quantifi':344C 'question':534C 'ref':106C,235C 'regular':89C,308C,339C,360C,384C 'releas':290C 'repo':105C,234C 'report':518C 'resourc':215C 'result':212C 'rubi':305C,315C,332C,370C,417C,421C,425C,429C,434C,439C,456C,523C 'run':125C 'runtim':410C,414C 'second':248C,320C 'secur':526C 'separ':122C 'servic':221C 'sever':83C,173C,485C,492C 'short':500C 'singl':175C 'single-vari':174C 'status':415C 'suppli':474C,515C 'templat':76C,80C,198C,201C,227C,261C,270C,483C,506C,509C 'test':402C 'thread':245C 'three':224C 'three-vari':223C 'timeout':501C 'trufflerubi':357C,387C,398C,449C,469C 'two':395C 'unaffect':265C,273C 'uncontrol':214C 'unpatch':477C 'upgrad':453C 'uri':75C,209C,252C,260C 'use':466C 'user':249C,266C,473C,514C 'user-suppli':472C,513C 'v1':152C 'v10':161C 'v2':153C 'v3':154C 'v4':155C 'v5':156C 'v6':157C 'v7':158C 'v8':159C 'v9':160C 'valu':116C 'variabl':84C,133C,141C,150C,171C,176C,225C,324C,486C 'version':275C,399C,478C 'vulner':91C,277C,301C,419C,423C,427C,445C,448C,451C 'way':138C 'whose':307C,359C 'within':73C 'without':312C 'workaround':452C 'yank':286C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-30T08:13:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9f42-57jx-vpp3","url":"https://github.com/advisories/GHSA-9f42-57jx-vpp3","severity":"medium","published_at":"2026-11-12T22:29:35+00:00","modified_at":"2026-11-12T22:30:31+00:00","first_seen_at":"2026-11-12T22:31:51+00:00","fetched_at":"2026-11-12T22:39:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-126352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126352","severity":null,"published_at":"2026-11-12T22:19:20+00:00","modified_at":"2026-11-12T22:19:20+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null}],"documents":[{"id":139738,"url":"https://api.github.com/repos/sporkmonger/addressable/security-advisories/GHSA-9f42-57jx-vpp3","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":139739,"url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-10-30T08:13:42+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":139740,"url":"https://github.com/sporkmonger/addressable/commit/f2b27b3ab252e56b3fa3519f7ebb491d54cf7b7c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":139737,"url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}