CVE-2026-126350 is a medium-severity (CVSS 5.9) CWE-1333 vulnerability in addressable. A fix is available for addressable — see the affected versions and patch details below.
Addressable: Regular Expression Denial of Service in templates with certain exploded expressions
Real-World Exposure
addressableReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Within the URI template implementation in Addressable, templates using the * (explode) modifier with the /, ., ;, ? or & operators (e.g., {/segments*}, {.ext*}, {;params*}, {?query*}) generate regular expressions vulnerable to catastrophic backtracking. When Template#match or Template#extract is called with a maliciously crafted URI that starts with the operator's leading character, matching takes exponential time, leading to uncontrolled resource consumption and denial of service. An input under 60 bytes is enough to occupy a thread for minutes.
GHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as fully remediated in 2.9.0. The 2.9.0 fix only made the joiner between exploded members mandatory for templates without an operator, and its regression specs used inputs that never start with the operator's leading character, so the vulnerable part of the expression was never reached. This issue was originally reported in #364 by @ebenoist in 2019 but insufficiently investigated.
Users of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call Template#expand are unaffected.
Affected Versions
This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.
The vulnerability is only exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. MRI Ruby 3.2 and later are not affected: their regular expression engine memoizes backtracking, so these patterns still match in linear time. TruffleRuby 40.0 is not affected either. Earlier TruffleRuby versions were not tested.
This has been confirmed on the following runtimes with Addressable 2.9.0:
| Runtime | Status |
|---|---|
| MRI Ruby 2.7 | Vulnerable |
| MRI Ruby 3.1 | Vulnerable |
| MRI Ruby 3.2 | Not affected |
| MRI Ruby 3.3 | Not affected |
| MRI Ruby 3.4 | Not affected |
| MRI Ruby 4.0 | Not affected |
| JRuby 9.4 | Vulnerable |
| TruffleRuby 40.0 | Not affected |
Workarounds
- Upgrade to MRI Ruby 3.2 or later, if the consuming application does not use JRuby.
- Avoid matching user-supplied input on unpatched versions of the library against templates that use the
*modifier with the/,.,;,?or&operators. - Apply a short timeout around any call to
Template#matchorTemplate#extractthat processes user-supplied data.
Credits
Reported independently by @ebenoist, @andrewstellman, and then @halogenandtoast.
For more information
If there are any questions or comments about this advisory:
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | addressable | ≥ 2.3.0&&< 2.9.1 | 2.9.1bundle update addressable --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for addressable, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update addressable to 2.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126350 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2026-126350 in your dependencies?
Find it across RubyGems, including transitive dependencies.