Executive brief
Addressable is a Ruby library used for URI parsing and template matching. A vulnerability in its template matching component allows an attacker to cause a denial of service by providing a specially crafted URI. This can lead to excessive CPU consumption, potentially making the application unresponsive and impacting business operations.
Technical details
The URI template implementation in Addressable generates regular expressions vulnerable to catastrophic backtracking. Specifically, templates using the '*' (explode) modifier generate patterns with nested unbounded quantifiers (O(2^n) complexity), and templates using multiple variables with '+' or '#' operators generate patterns with O(n^k) complexity due to ambiguous backtracking across variables. An attacker can exploit this by providing a malicious URI to be matched against a vulnerable template, leading to uncontrolled resource consumption. The issue is fully remediated in version 2.9.0. MRI Ruby 3.2+ provides partial mitigation via Onigmo memoization, but JRuby and TruffleRuby remain fully vulnerable until the library is patched.
Affected products
- sporkmonger addressable >= 2.3.0, < 2.9.0
Timeline
- 2026-04-04: disclosed: Advisory published by maintainer
- 2026-04-07: advisory: NVD published CVE-2026-35611
- 2026-04-08: patched: Full remediation in version 2.9.0