Is CVE-2026-126350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126350 being exploited in the wild.

How severe is CVE-2026-126350?

Medium severity, with a CVSS score of 5.9, published 12 November 2026.

Which products and versions are affected?

Addressable 2.3.0 to 2.9.0; addressable (RubyGems) >= 2.3.0, < 2.9.1.

Is there a fix for CVE-2026-126350?

Yes: fixed in Addressable 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126350 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126350?

Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126350: Addressable regular expression denial of service in URI template matching

Q: Is there a fix for CVE-2026-126350?

Yes: fixed in Addressable 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126350 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-126350?

Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126350 · Severity: medium · CVSS 5.9 · Published 2026-11-12

Addressable is a Ruby library that parses and generates URIs, used by many web applications. Versions 2.3.0 through 2.9.0 contain a flaw in URI template processing that allows an attacker to send specially crafted URIs to cause excessive CPU consumption and application slowdown. This vulnerability only affects Ruby versions before 3.2 and JRuby, and is triggered when applications use Addressable's Template#match or Template#extract functions.

Technologies: Addressable, addressable (RubyGems). Vendors: Addressable, RubyGems.

Quick answers

Is CVE-2026-126350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126350 being exploited in the wild.
How severe is CVE-2026-126350?: Medium severity, with a CVSS score of 5.9, published 12 November 2026.
Which products and versions are affected?: Addressable 2.3.0 to 2.9.0; addressable (RubyGems) >= 2.3.0, < 2.9.1.
Is there a fix for CVE-2026-126350?: Yes: fixed in Addressable 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126350 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126350?: Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Addressable 2.9.1

Technical details

URI template expressions using the explode modifier with slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions that cause catastrophic backtracking. When Template#match or Template#extract processes an attacker-controlled URI starting with these operator characters, optional member separators create exponential parsing paths. The vulnerability affects MRI Ruby before 3.2 and JRuby; URI parsing and Template#expand are unaffected.

Affected products

Addressable Addressable 2.3.0 to 2.9.0

Identifiers

CVE-2026-126350
GHSA-j82w-28jv-3pmj

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.