CVE-2026-126350
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
12/11/2026
Última modificación:
12/11/2026
Descripción
*** Pendiente de traducción *** Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.
Impacto
Puntuación base 3.x
5.90
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e
- https://github.com/sporkmonger/addressable/issues/364
- https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1
- https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj