CVE-2026-126354

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1.

• CWE-22
• CWE-436

• https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5
• https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126349Addressable is an alternative implementation to the URI impl…3.1
• CVE-2026-12635GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-126350Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126351Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126352Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126353Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126357Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126358Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126359Hono is a Web application framework that provides support fo…3.4
• CVE-2026-126360OpenTelemetry Python provides the Python API and SDK for Ope…5.3