CVE-2026-126353 · Package
NO FIX YET · SEE WHAT TO DO
Addressable is a Ruby library for parsing and expanding URIs and URI templates. Template#match and Template#extract on an attacker-supplied URI can take polynomial time, tying up a thread and causing denial of service.
first public Oct 30, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that call Addressable's Template#match or Template#extract on attacker-controlled URIs are exposed, and only on the affected Ruby runtimes. Apps on MRI Ruby 3.3 or later, apps that only parse URIs or call Template#expand, and apps that do not handle untrusted URI templates can skip it.
Not affected if expand-only, no-untrusted-template-match, ruby-3.3-or-later
Who cares addressable, jruby, ruby, truffleruby
addressable below 2.9.1 is affected.3.2, or the app uses JRuby or TruffleRuby 40.0 (or + or # expressions on MRI Ruby 3.2), since those are the affected runtimes.addressable 2.9.1Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.