CVE-2026-126350

Name of the Vulnerable Software and Affected Versions Addressable versions 2.3.0 through 2.9.0

Description URI template expressions using the explode modifier * with the /, ., ;, ?, or & operators generate ambiguous regular expressions. When the Template#match or Template#extract functions process a maliciously crafted URI that begins with the operator's leading character, it can trigger catastrophic backtracking. Catastrophic backtracking is a condition where a regular expression engine takes exponential time to determine that a string does not match a pattern, leading to uncontrolled resource consumption and denial of service. This issue specifically affects JRuby and MRI Ruby versions prior to 3.2. An input smaller than 60 bytes can occupy a thread for several minutes.

Recommendations Update Addressable to version 2.9.1. Upgrade to MRI Ruby 3.2 or later. Avoid matching user-supplied input against templates that use the * modifier with the /, ., ;, ?, or & operators. Apply a short timeout around calls to Template#match or Template#extract when processing user-supplied data.