CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.

• CWE-1333

• https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4Mitigation, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35605File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-35606File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-35607File Browser is a file managing interface for uploading, del…8.8
• CVE-2026-35608QuickDrop is an easy-to-use file sharing application. Prior …6.1
• CVE-2026-3561Philips Hue Bridge hk_hap characteristics Heap-based Buffer …8
• CVE-2026-35610PolarLearn is a free and open-source learning program. In 0-…8.8
• CVE-2026-35613coursevault-preview is a utility for previewing course mater…4.7
• CVE-2026-35614Frappe is a full-stack web application framework. Prior to 1…9.8
• CVE-2026-35615PraisonAI is a multi-agent teams system. Prior to 1.5.113, _…7.5
• CVE-2026-35616A improper access control vulnerability in Fortinet FortiCli…9.8
• CVE-2026-35617OpenClaw before 2026.3.25 contains an authorization bypass v…5.4
• CVE-2026-35618OpenClaw before 2026.3.23 contains a replay identity vulnera…8.3