CVE-2026-35611
published 2026-04-07CVE-2026-35611: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.36%
28.5th percentile
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| addressable_project | addressable | >= 2.3.0 < 2.9.0 | 2.9.0 |
| addressable_project | addressable | >= 2.3.0 < 2.9.0 | 2.9.0 |
| debian | ruby-addressable | — | — |
| sporkmonger | addressable | — | — |
| ubuntu | ruby-addressable | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Addressable vulnerability
vendor_ubuntu·2026-07-07
CVE-2026-35611 Addressable vulnerability
Title: Addressable vulnerability
Summary: Addressable could be made to consume resources and cause a denial of
service if it received specially crafted input.
It was discovered that Addressable incorrectly handled certain URI
templates, generating regular expressions vulnerable to catastrophic
backtracking. An attacker could use this issue to craft a URI that, when matched
against a vulnerable template, causes excessive resource consumption,
leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
addressable: Addressable: Denial of Service via crafted URI templates
vendor_redhat·2026-04-07·CVSS 7.5
CVE-2026-35611 [HIGH] CWE-1333 addressable: Addressable: Denial of Service via crafted URI templates
addressable: Addressable: Denial of Service via crafted URI templates
A flaw was found in Addressable. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a maliciously crafted Uniform Resource Identifier (URI) to the URI template implementation. Specifically, certain URI templates using the explode modifier or multiple variables with the plus or hash operators generate regular expressions vulnerable to catastrophic backtracking, leading to uncontrolled resource consumption.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: 3scale-amp21/system (
Debian
CVE-2026-35611: ruby-addressable - Addressable is an alternative implementation to the URI implementation that is p...
vendor_debian·2026·CVSS 7.5
CVE-2026-35611 [HIGH] CVE-2026-35611: ruby-addressable - Addressable is an alternative implementation to the URI implementation that is p...
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. Wh
VulDB
sporkmonger addressable up to 2.8.x redos (GHSA-h27x-rffw-24p4 / Nessus ID 305616)
vuldb·2026-04-13·CVSS 7.5
CVE-2026-35611 [HIGH] sporkmonger addressable up to 2.8.x redos (GHSA-h27x-rffw-24p4 / Nessus ID 305616)
A vulnerability labeled as problematic has been found in sporkmonger addressable up to 2.8.x. The affected element is an unknown function. Executing a manipulation can lead to inefficient regular expression complexity.
The identification of this vulnerability is CVE-2026-35611. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
Addressable has a Regular Expression Denial of Service in Addressable templates
ghsa·2026-04-08
CVE-2026-35611 [HIGH] CWE-1333 Addressable has a Regular Expression Denial of Service in Addressable templates
Addressable has a Regular Expression Denial of Service in Addressable templates
### Impact
Within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking:
1. Templates using the `*` (explode) modifier with any expansion operator (e.g., `{foo*}`, `{+var*}`, `{#var*}`, `{/var*}`, `{.var*}`, `{;var*}`, `{?var*}`, `{&var*}`) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI.
2. Templates using multiple variables with the `+` or `#` operators (e.g., `{+v1,v2,v3}`) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables.
When matched agai
OSV
Addressable has a Regular Expression Denial of Service in Addressable templates
osv·2026-04-08
CVE-2026-35611 [HIGH] Addressable has a Regular Expression Denial of Service in Addressable templates
Addressable has a Regular Expression Denial of Service in Addressable templates
### Impact
Within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking:
1. Templates using the `*` (explode) modifier with any expansion operator (e.g., `{foo*}`, `{+var*}`, `{#var*}`, `{/var*}`, `{.var*}`, `{;var*}`, `{?var*}`, `{&var*}`) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI.
2. Templates using multiple variables with the `+` or `#` operators (e.g., `{+v1,v2,v3}`) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables.
When matched agai
OSV
CVE-2026-35611: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library
osv·2026-04-07·CVSS 7.5
CVE-2026-35611 [HIGH] CVE-2026-35611: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. Wh
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-35611 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-35611 [HIGH] CVE-2026-35611 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35611 :
Ruby vulnerability analysis and mitigation
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched chara
Wiz
CVE-2026-40070 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-40070 [MEDIUM] CVE-2026-40070 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-40070 :
Ruby vulnerability analysis and mitigation
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certif
Wiz
CVE-2026-40069 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-40069 [MEDIUM] CVE-2026-40069 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-40069 :
Ruby vulnerability analysis and mitigation
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
Source : NVD
## 7.5
Score
Published April 9, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Ruby
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Expl
Wiz
CVE-2026-39324 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-39324 [MEDIUM] CVE-2026-39324 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-39324 :
Ruby vulnerability analysis and mitigation
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is fixed in 2.1.2.
Source : NVD
## 9.3
Score
Published April 7, 2026
Severity CRITICAL
CNA Score 9.3
Affected Tec
Bugzilla
CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
bugzilla·2026-04-07·CVSS 7.5
CVE-2026-35611 [HIGH] CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being wit
2026-04-07
Published