CVE-2021-32740 — Uncontrolled Resource Consumption

Vendor	Product	Version range	Fixed in
addressable_project	addressable	>= 2.3.0 < 2.8.0	2.8.0
addressable_project	addressable	>= 2.3.0 < 2.8.0	2.8.0
debian	ruby-addressable	< ruby-addressable 2.7.0-2 (bookworm)	ruby-addressable 2.7.0-2 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
msrc	cm1_rubygem-addressable_2.8.0-1_on_cbl_mariner_1.0	—	—
sporkmonger	addressable	—	—

OSV

Regular Expression Denial of Service in Addressable templates

osv·2021-07-12

CVE-2021-32740 [HIGH] Regular Expression Denial of Service in Addressable templates Regular Expression Denial of Service in Addressable templates ### Impact Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. ### Patches The vulnerability was introduced in version 2.3.0 (previously yanked) and has been present in all subsequent versions up to, and including, 2.7.0. It is fixed in version 2.8.0. ### Workarounds The vulnerability can be avoided by only c

GHSA

Regular Expression Denial of Service in Addressable templates

ghsa·2021-07-12

CVE-2021-32740 [HIGH] CWE-1333 Regular Expression Denial of Service in Addressable templates Regular Expression Denial of Service in Addressable templates ### Impact Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. ### Patches The vulnerability was introduced in version 2.3.0 (previously yanked) and has been present in all subsequent versions up to, and including, 2.7.0. It is fixed in version 2.8.0. ### Workarounds The vulnerability can be avoided by only c

OSV

CVE-2021-32740: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library

osv·2021-07-06·CVSS 7.5

CVE-2021-32740 [HIGH] CVE-2021-32740: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources

Microsoft

Regular Expression Denial of Service in Addressable templates

vendor_msrc·2021-07-13·CVSS 7.5

CVE-2021-32740 [HIGH] CWE-400 Regular Expression Denial of Service in Addressable templates Regular Expression Denial of Service in Addressable templates FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: h

Red Hat

rubygem-addressable: ReDoS in templates

vendor_redhat·2021-07-03·CVSS 7.5

CVE-2021-32740 [HIGH] CWE-400 rubygem-addressable: ReDoS in templates rubygem-addressable: ReDoS in templates Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only cre

Debian

CVE-2021-32740: ruby-addressable - Addressable is an alternative implementation to the URI implementation that is p...

vendor_debian·2021·CVSS 7.5

CVE-2021-32740 [HIGH] CVE-2021-32740: ruby-addressable - Addressable is an alternative implementation to the URI implementation that is p... Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources

CVE-2021-32740: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption…

Affected

CVSS provenance