CVE-2026-126354

Name of the Vulnerable Software and Affected Versions Addressable versions 2.2.5 through 2.9.0

Description An interpretation conflict exists in how Addressable::URI.normalize path resolves paths containing parent segments (..) compared to the RFC 3986 standard. When a path contains leading parent segments that climb above the root before other segments are resolved, the software may incorrectly retain segments that should have been removed. This behavior affects URI#normalize, URI#join, URI#==, and URI#===.

This can lead to path traversal if an application performs authorization checks on a path normalized by Addressable but sends the original URI to a different resolver (such as a web server or proxy) that follows RFC 3986. An attacker could potentially bypass allowlists to access restricted paths.

Recommendations Update Addressable to version 2.9.1. As a temporary workaround, reject any paths containing .. segments, including percent-encoded forms like %2e%2e, before making access decisions. As a temporary workaround, use the same normalized value for both the authorization check and the subsequent request.