GHSA-9f42-57jx-vpp3

Suggest an improvement
Source
https://github.com/advisories/GHSA-9f42-57jx-vpp3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9f42-57jx-vpp3
Aliases
  • CVE-2026-126352
Published
2026-11-12T22:29:35Z
Modified
2026-11-12T22:45:04Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Addressable: Regular Expression Denial of Service in templates with multiple variables
Details

Impact

Within the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking:

  1. Expressions with any operator other than + and # (e.g., {/owner,repo,ref}, {.a,b}, {a,b,c}, {;a,b,c}). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables.
  2. Expressions with the + or # operators and many variables (e.g., {+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}). A failing match is exponential in the number of variables.
  3. Several single-variable expressions next to each other (e.g., {+a}{+b}{+c} or {a}{b}{c}), which are polynomial in the input length.

When Template#match or Template#extract is called with a maliciously crafted URI, this can result in uncontrolled resource consumption, leading to denial of service. A three-variable path template such as http://example.com/repos{/owner,repo,ref} needs about 2 KB of input to occupy a thread for many seconds.

Users of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call Template#expand are unaffected.

Affected Versions

This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.

The vulnerability is exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. The second form, many-variable + and # expressions, is also exploitable on MRI Ruby 3.2, which does not memoize a regular expression that contains possessive quantifiers, and 2.9.0 generates those for these operators. It is also exploitable on TruffleRuby 40.0, whose regular expression engine falls back to backtracking for them. MRI Ruby 3.3 and later are not affected by any form, because they memoize those regular expressions too. TruffleRuby 40.0 is not affected by the other two forms. Earlier TruffleRuby versions were not tested.

This has been confirmed on the following runtimes with Addressable 2.9.0:

Runtime Status
MRI Ruby 2.7 Vulnerable
MRI Ruby 3.1 Vulnerable
MRI Ruby 3.2 Vulnerable
MRI Ruby 3.3 Not affected
MRI Ruby 3.4 Not affected
MRI Ruby 4.0 Not affected
JRuby 9.4 Vulnerable
JRuby 10.1 Vulnerable
TruffleRuby 40.0 Vulnerable

Workarounds

  • Upgrade to MRI Ruby 3.3 or later, if a consuming application does not use JRuby or TruffleRuby.
  • Avoid matching user-supplied input on unpatched versions of the library against templates with several variables in one expression, or with several expressions next to each other.
  • Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data.

Credits

Reported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security.

For more information

If there are any questions or comments about this advisory:

Database specific 
{
    "cwe_ids": [
        "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-12T22:29:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

RubyGems / addressable

Package

Name
addressable
Purl
pkg:gem/addressable

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.9.1

Affected versions

2.*
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.8.10
2.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json"