CVE-2026-35611 Details
Description
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.
A denial-of-service vulnerability has been identified in the Addressable library, specifically in versions 2.3.0 prior to 2.9.0. The issue arises within the URI template implementation, where certain templates generate regular expressions susceptible to catastrophic backtracking. This vulnerability can be exploited by crafting a malicious URI that, when processed by the vulnerable regular expression, leads to excessive backtracking and resource consumption, causing a denial-of-service condition. The vulnerability is more easily exploitable on MRI Ruby versions prior to 3.2, as well as on all versions of JRuby and TruffleRuby.
Users can upgrade to Addressable version 2.9.0 or later. If using MRI Ruby, upgrade to version 3.2 or later, as this version includes a memoization feature that prevents catastrophic backtracking for certain vulnerable URI template patterns. For applications using JRuby or TruffleRuby, additional steps may be needed, as these runtimes do not benefit from the same protections.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| addressable project addressable | >= 2.3.0, < 2.9.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |