- Severity: MEDIUM
- CVE: CVE-2026-126352
- Ecosystems: rubygems
- Packages: addressable
### Impact
Within the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking:
1. Expressions with any operator other than `+` and `#` (e.g., `{/owner,repo,ref}`, `{.a,b}`, `{a,b,c}`, `{;a,b,c}`). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables.
2. Expressions with the `+` or `#` operators and many variables (e.g., `{+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}`). A failing match is exponential in the number of variables.
3. Several single-variable expressions next to each other (e.g., `{+a}{+b}{+c}` or `{a}{b}{c}`), which are polynomial in the input length.
When `Template#match` or `Template#extract` is called with a maliciously crafted URI, this can result in uncontrolled resource consumption, leading to denial of service. A three-variable path template such as `http://example.com/repos{/owner,repo,ref}` needs about 2 KB of input to occupy a thread for many seconds.
Users of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.
### Affected Versions
This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.
The vulnerability is exploitable on Ruby implementations whose regu…
Source: GitHub Security Advisories · 2026-11-12