# CVE-2026-126351: Addressable URI path normalization denial of service

Source: https://junglewise.ai/threats/cve-2026-126351-addressable-is-an-alternative-implementation-to-the-uri  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126351 · Severity: medium · CVSS 5.9 · Published 2026-11-12

Addressable is a Ruby library that parses and manipulates URIs. An attacker can craft a malicious URI with many nested path segments to consume excessive CPU time during path normalization, causing denial of service on any application that uses this functionality. Applications that only parse URIs without normalizing, comparing, or joining them are not affected.

Technologies: [Addressable](https://junglewise.ai/threats/technologies/addressable-addressable), [addressable (RubyGems)](https://junglewise.ai/threats/technologies/addressable). Vendors: [Addressable](https://junglewise.ai/threats/vendors/addressable), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126351 being exploited in the wild.

**How severe is CVE-2026-126351?** Medium severity, with a CVSS score of 5.9, published 12 November 2026.

**Which products and versions are affected?** Addressable before 2.9.1; addressable (RubyGems) < 2.9.1.

**Is there a fix for CVE-2026-126351?** Yes: fixed in 2.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126351 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126351?** Check whether you run Addressable or addressable (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.9.1

## Technical details

Addressable::URI.normalize_path performed quadratic-time work by repeatedly scanning and rewriting paths to remove only one nested dot segment per pass. The vulnerability affects URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== methods. An attacker can supply a URI with many dot segments through any input that triggers path normalization to exhaust a worker thread.

## Affected products

- Addressable Addressable before 2.9.1

## Identifiers

- CVE-2026-126351
- GHSA-qq38-m9mg-xjj5

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5](https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5)
- [https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1](https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1)

## Related threats

- [Addressable URI.normalize_path path traversal and bypass](https://junglewise.ai/threats/cve-2026-126354-addressable-uri-normalization-resolves-some-dotted-path-segments)
- [Addressable URI template ReDoS denial of service](https://junglewise.ai/threats/cve-2026-126352-addressable-is-an-alternative-implementation-to-the-uri)
- [Addressable regular expression denial of service in URI template matching](https://junglewise.ai/threats/cve-2026-126350-addressable-is-an-alternative-implementation-to-the-uri)
- [Addressable display_uri can show misleading hosts containing bidi and invisible characters](https://junglewise.ai/threats/cve-2026-126349-addressable-is-an-alternative-implementation-to-the-uri)
- [Addressable punycode decoding host spoofing](https://junglewise.ai/threats/cve-2026-126348-addressable-is-an-alternative-implementation-to-the-uri)