Source: ruby-addressable
Version: 2.8.9-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for ruby-addressable.
CVE-2026-35611[0]:
| Addressable is an alternative implementation to the URI
| implementation that is part of Ruby's standard library. From 2.3.0
| to before 2.9.0, within the URI template implementation in
| Addressable, two classes of URI template generate regular
| expressions vulnerable to catastrophic backtracking. Templates using
| the * (explode) modifier with any expansion operator (e.g., {foo*},
| {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*})
| generate patterns with nested unbounded quantifiers that are O(2^n)
| when matched against a maliciously crafted URI. Templates using
| multiple variables with the + or # operators (e.g., {+v1,v2,v3})
| generate patterns with O(n^k) complexity due to the comma separator
| being within the matched character class, causing ambiguous
| backtracking across k variables. When matched against a maliciously
| crafted URI, this can result in catastrophic backtracking and
| uncontrolled resource consumption, leading to denial of service.
| This vulnerability is fixed in 2.9.0.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-35611
https://www.cve.org/CVERecord?id=CVE-2026-35611
[1]
https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
