Is CVE-2026-126351 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126351 being exploited in the wild.

How severe is CVE-2026-126351?

Medium severity, with a CVSS score of 5.9, published 12 November 2026.

Which products and versions are affected?

Addressable before 2.9.1; addressable (RubyGems) < 2.9.1.

Is there a fix for CVE-2026-126351?

Yes: fixed in 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126351 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126351?

Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126351: Addressable URI path normalization denial of service

Q: Is there a fix for CVE-2026-126351?

Yes: fixed in 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126351 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126351?

Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126351 · Severity: medium · CVSS 5.9 · Published 2026-11-12

Addressable is a Ruby library that parses and manipulates URIs. An attacker can craft a malicious URI with many nested path segments to consume excessive CPU time during path normalization, causing denial of service on any application that uses this functionality. Applications that only parse URIs without normalizing, comparing, or joining them are not affected.

Technologies: Addressable, addressable (RubyGems). Vendors: Addressable, RubyGems.

Quick answers

Is CVE-2026-126351 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126351 being exploited in the wild.
How severe is CVE-2026-126351?: Medium severity, with a CVSS score of 5.9, published 12 November 2026.
Which products and versions are affected?: Addressable before 2.9.1; addressable (RubyGems) < 2.9.1.
Is there a fix for CVE-2026-126351?: Yes: fixed in 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126351 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126351?: Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.9.1

Technical details

Addressable::URI.normalize_path performed quadratic-time work by repeatedly scanning and rewriting paths to remove only one nested dot segment per pass. The vulnerability affects URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== methods. An attacker can supply a URI with many dot segments through any input that triggers path normalization to exhaust a worker thread.

Affected products

Addressable Addressable before 2.9.1

Identifiers

CVE-2026-126351
GHSA-qq38-m9mg-xjj5

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.