PT-2026-30910 · Unknown · Addressable

Sporkmonger · Published 2026-04-07 · Updated 2026-04-17 · CVE-2026-35611

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Addressable versions 2.3.0 through 2.8.9

Description Addressable, an alternative URI implementation for Ruby, contains a flaw in its URI template implementation. Templates utilizing the '' (explode) modifier with any expansion operator (e.g., {foo}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate regular expressions susceptible to catastrophic backtracking when matched against crafted URIs. Similarly, templates with multiple variables using the '+' or '#' operators (e.g., {+v1,v2,v3}) can also lead to catastrophic backtracking due to the comma separator within the matched character class. This can result in uncontrolled resource consumption and denial of service.

Recommendations Update to version 2.9.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-35611

GHSA-H27X-RFFW-24P4

OESA-2026-1967

Affected Products

Addressable

References · 16

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/CVE-2026-35611.yml · Exploit
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1967 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35611 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35611 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35611 · Security Note
• https://ubuntu.com/security/CVE-2026-35611 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35611 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h27x-rffw-24p4 · Vendor Advisory
• https://github.com/sporkmonger/addressable/commit/0afcb0b9672bee301e5e96ed850fec05b2fcabb0 · Note
• https://github.com/sporkmonger/addressable/commit/91915c1f7aafa3e2c9f42e2f4e21d948c7a861b8 · Note
• https://github.com/sporkmonger/addressable/commit/c87f768f22ab00376ed2f8cb106f59c9d0652d3a · Note
• https://github.com/sporkmonger/addressable · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1967 · Note