CVE-2021-32740

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

• CWE-400
• CWE-400

• https://github.com/sporkmonger/addressable/commit/0d8a3127e35886ce9284810a7f2438bff6b43cbcPatch, Release Notes, Third Party Advisory
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-jxhc-q857-3j6gThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDFQM2NHNAZ3NNUQZEJTYECYZYXV4UDS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYPVOOQU7UB277UUERJMCNQLRCXRCIQ5/
• https://github.com/sporkmonger/addressable/commit/0d8a3127e35886ce9284810a7f2438bff6b43cbcPatch, Release Notes, Third Party Advisory
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-jxhc-q857-3j6gThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDFQM2NHNAZ3NNUQZEJTYECYZYXV4UDS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYPVOOQU7UB277UUERJMCNQLRCXRCIQ5/

Published

Jul 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32734Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32735Kirby is a content management system. In Kirby CMS versions …5.4
• CVE-2021-32736think-helper defines a set of helper functions for ThinkJS. …7.5
• CVE-2021-32737Sulu is an open-source PHP content management system based o…4.8
• CVE-2021-32738js-stellar-sdk is a Javascript library for communicating wit…6.5
• CVE-2021-32739Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32741Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32742Vapor is a web framework for Swift. In versions 4.47.1 and p…9.1
• CVE-2021-32743Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32744Collabora Online is a collaborative online office suite. In …7.5
• CVE-2021-32745Collabora Online is a collaborative online office suite. A r…6.1
• CVE-2021-32746Icinga Web 2 is an open source monitoring web interface, fra…5.3