CVE-2026-126350

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.

• CWE-1333

• https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e
• https://github.com/sporkmonger/addressable/issues/364
• https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126345basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the …5.3
• CVE-2026-126346basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPC…5.9
• CVE-2026-126347Tornado is a Python web framework and asynchronous networkin…3.1
• CVE-2026-126348Addressable is an alternative implementation to the URI impl…4.3
• CVE-2026-126349Addressable is an alternative implementation to the URI impl…3.1
• CVE-2026-12635GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-126351Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126352Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126353Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126354Addressable is an alternative implementation to the URI impl…4.8
• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3