{"api_version":"1","generated_at":"2026-11-12T23:54:17+00:00","cve":"CVE-2026-126350","urls":{"html":"https://cve.report/CVE-2026-126350","api":"https://cve.report/api/cve/CVE-2026-126350.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-126350","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-126350"},"summary":{"title":"Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions","description":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-11-12 22:19:20","updated_at":"2026-11-12 22:19:20"},"problem_types":["CWE-1333","CWE-1333 CWE-1333: Inefficient Regular Expression Complexity"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1","name":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e","name":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/sporkmonger/addressable/issues/364","name":"https://github.com/sporkmonger/addressable/issues/364","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj","name":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-126350","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126350","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"sporkmonger","product":"addressable","version":"affected >= 2.3.0, < 2.9.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1333","description":"CWE-1333: Inefficient Regular Expression Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T22:04:01.521Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"},{"name":"https://github.com/sporkmonger/addressable/issues/364","tags":["x_refsource_MISC"],"url":"https://github.com/sporkmonger/addressable/issues/364"},{"name":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e","tags":["x_refsource_MISC"],"url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"name":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1","tags":["x_refsource_MISC"],"url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"source":{"advisory":"GHSA-j82w-28jv-3pmj","discovery":"UNKNOWN"},"title":"Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-126350","datePublished":"2026-11-12T22:04:01.521Z","dateReserved":"2026-11-10T21:12:01.227Z","dateUpdated":"2026-11-12T22:04:01.521Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 22:19:20","lastModifiedDate":"2026-11-12 22:19:20","problem_types":["CWE-1333","CWE-1333 CWE-1333: Inefficient Regular Expression Complexity"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"126350","Ordinal":"1","Title":"Addressable: Regular Expression Denial of Service in Addressable","CVE":"CVE-2026-126350","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"126350","Ordinal":"1","NoteData":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.","Type":"Description","Title":"Addressable: Regular Expression Denial of Service in Addressable"}]}}}