CVE-2026-126351

Name of the Vulnerable Software and Affected Versions Addressable versions prior to 2.9.1

Description An issue exists where Addressable::URI.normalize path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, resulting in quadratic work. This behavior is inherited by URI#normalize, URI#normalized path, URI#join, URI#==, and URI#===. Processing a sufficiently long URI controlled by an attacker can lead to uncontrolled resource consumption, consuming a worker thread and causing a denial of service across all Ruby implementations. This occurs when normalizing, comparing, or joining URIs taken from untrusted user input.

Recommendations Update to version 2.9.1. Limit the length of URIs taken from user input before calling normalize, ==, or join. Reject paths containing many dot segments before normalizing them.