CVE-2026-126352

Name of the Vulnerable Software and Affected Versions Addressable versions 2.3.0 through 2.9.0

Description URI templates containing multiple variables in one expression or several adjacent expressions generate ambiguous regular expressions. When Template#match or Template#extract functions are called with a maliciously crafted URI, the regular expression engine may perform excessive backtracking, leading to uncontrolled resource consumption and denial of service. This occurs in three specific scenarios: expressions using operators other than + and #, expressions with many variables using + or # operators, and adjacent single-variable expressions. The issue affects MRI Ruby versions prior to 3.2 and JRuby, while the large plus and number-sign forms also affect MRI Ruby 3.2 and TruffleRuby 40.0.

Recommendations Update Addressable to version 2.9.1. Upgrade to MRI Ruby 3.3 or later. Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data. Avoid matching user-supplied input against templates with several variables in one expression or several expressions next to each other.