CVE-2026-126353

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126353

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126353.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126353

Aliases

GHSA-4w5q-wg7v-w6gp

Downstream

UBUNTU-CVE-2026-126353

Published

2026-11-12T22:10:14Z

Modified

2026-11-14T02:47:27Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Addressable: Regular Expression Denial of Service in Addressable templates with several exploded variables

Details

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126353.json"
}

References

Affected packages

Git / github.com/sporkmonger/addressable

Affected ranges

Type

GIT

Repo

https://github.com/sporkmonger/addressable

Events

Introduced

768b408ef1e731bb3c9fdf29fbcf23cad5c42d18

Fixed

afa66636d9fdcca11e03c85cf166651e0efa68ef

Fixed

49aecf97bf6f6675717f1078a0b45f95c428e103

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.3.0"
                },
                {
                    "fixed": "2.9.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "49aecf97bf6f6675717f1078a0b45f95c428e103"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "addressable-2.9.1",
            "range": [
                {
                    "fixed": "afa66636d9fdcca11e03c85cf166651e0efa68ef"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

addressable-2.*

addressable-2.3.0

addressable-2.3.1

addressable-2.3.2

addressable-2.3.3

addressable-2.3.4

addressable-2.3.5

addressable-2.3.6

addressable-2.3.7

addressable-2.3.8

addressable-2.4.0

addressable-2.5.0

addressable-2.5.1

addressable-2.5.2

addressable-2.6.0

addressable-2.7.0

addressable-2.8.1

addressable-2.8.10

addressable-2.8.2

addressable-2.8.3

addressable-2.8.4

addressable-2.8.5

addressable-2.8.6

addressable-2.8.7

addressable-2.8.8

addressable-2.8.9

addressable-2.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126353.json"