CVE-2026-126354

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126354

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126354.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126354

Aliases

GHSA-8gmh-2hhj-2hv9

Downstream

CGA (14)

Published

2026-11-12T22:11:07Z

Modified

2026-11-13T10:46:01Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Addressable URI normalization resolves some dotted path segments to the wrong path

Details

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-436"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126354.json"
}

References

Affected packages

Git / github.com/sporkmonger/addressable

Affected ranges

Type

GIT

Repo

https://github.com/sporkmonger/addressable

Events

Introduced

354f223087425c5d028f19794b07682af93dd4ed

Fixed

afa66636d9fdcca11e03c85cf166651e0efa68ef

Fixed

25c7c412a2f7e06c3cac92872e831f6d053703c5

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.2.5"
                },
                {
                    "fixed": "2.9.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "25c7c412a2f7e06c3cac92872e831f6d053703c5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "addressable-2.9.1",
            "range": [
                {
                    "fixed": "afa66636d9fdcca11e03c85cf166651e0efa68ef"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

addressable-2.*

addressable-2.2.5

addressable-2.2.6

addressable-2.2.7

addressable-2.2.8

addressable-2.3.0

addressable-2.3.1

addressable-2.3.2

addressable-2.3.3

addressable-2.3.4

addressable-2.3.5

addressable-2.3.6

addressable-2.3.7

addressable-2.3.8

addressable-2.4.0

addressable-2.5.0

addressable-2.5.1

addressable-2.5.2

addressable-2.6.0

addressable-2.7.0

addressable-2.8.1

addressable-2.8.10

addressable-2.8.2

addressable-2.8.3

addressable-2.8.4

addressable-2.8.5

addressable-2.8.6

addressable-2.8.7

addressable-2.8.8

addressable-2.8.9

addressable-2.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126354.json"