CVE-2026-126351

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1.

• CWE-407

• https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5
• https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126346basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPC…5.9
• CVE-2026-126347Tornado is a Python web framework and asynchronous networkin…3.1
• CVE-2026-126348Addressable is an alternative implementation to the URI impl…4.3
• CVE-2026-126349Addressable is an alternative implementation to the URI impl…3.1
• CVE-2026-12635GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-126350Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126352Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126353Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126354Addressable is an alternative implementation to the URI impl…4.8
• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126357Hono is a Web application framework that provides support fo…5.3