CVE-2026-126351

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126351

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126351.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126351

Aliases

GHSA-qq38-m9mg-xjj5

Downstream

AZL (1)

AZL-113813

CGA (12)

Published

2026-11-12T22:05:39Z

Modified

2026-11-13T10:46:37Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Addressable: Denial of service in URI path normalization

Details

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126351.json"
}

References

Affected packages

Git / github.com/sporkmonger/addressable

Affected ranges

Type

GIT

Repo

https://github.com/sporkmonger/addressable

Events

Introduced

Fixed

afa66636d9fdcca11e03c85cf166651e0efa68ef

Fixed

25c7c412a2f7e06c3cac92872e831f6d053703c5

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.9.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "25c7c412a2f7e06c3cac92872e831f6d053703c5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "addressable-2.9.1",
            "range": [
                {
                    "fixed": "afa66636d9fdcca11e03c85cf166651e0efa68ef"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

addressable-2.*

addressable-2.0.0

addressable-2.0.1

addressable-2.0.2

addressable-2.1.0

addressable-2.1.1

addressable-2.1.2

addressable-2.2.0

addressable-2.2.1

addressable-2.2.2

addressable-2.2.3

addressable-2.2.4

addressable-2.2.5

addressable-2.2.6

addressable-2.2.7

addressable-2.2.8

addressable-2.3.0

addressable-2.3.1

addressable-2.3.2

addressable-2.3.3

addressable-2.3.4

addressable-2.3.5

addressable-2.3.6

addressable-2.3.7

addressable-2.3.8

addressable-2.4.0

addressable-2.5.0

addressable-2.5.1

addressable-2.5.2

addressable-2.6.0

addressable-2.7.0

addressable-2.8.1

addressable-2.8.10

addressable-2.8.2

addressable-2.8.3

addressable-2.8.4

addressable-2.8.5

addressable-2.8.6

addressable-2.8.7

addressable-2.8.8

addressable-2.8.9

addressable-2.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126351.json"