CVE-2026-35611

{
  "id": "CVE-2026-35611",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:35.427",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0."
    },
    {
      "lang": "es",
      "value": "Addressable es una implementación alternativa a la implementación de URI que forma parte de la biblioteca estándar de Ruby. Desde la versión 2.3.0 hasta antes de la 2.9.0, dentro de la implementación de plantillas URI en Addressable, dos clases de plantillas URI generan expresiones regulares vulnerables a un retroceso catastrófico. Las plantillas que utilizan el modificador * (explode) con cualquier operador de expansión (por ejemplo, {foo}, {+var}, {#var}, {/var}, {.var}, {;var}, {?var}, {&var}) generan patrones con cuantificadores anidados ilimitados que son O(2^n) cuando se comparan con una URI maliciosamente elaborada. Las plantillas que utilizan múltiples variables con los operadores + o # (por ejemplo, {+v1,v2,v3}) generan patrones con una complejidad O(n^k) debido a que el separador de coma está dentro de la clase de caracteres coincidentes, lo que provoca un retroceso ambiguo a través de k variables. Cuando se compara con una URI maliciosamente elaborada, esto puede resultar en un retroceso catastrófico y un consumo de recursos incontrolado, lo que lleva a una denegación de servicio. Esta vulnerabilidad se corrige en la versión 2.9.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sporkmonger",
          "product": "addressable",
          "versions": [
            {
              "version": ">= 2.3.0, < 2.9.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T14:36:09.398733Z",
          "id": "CVE-2026-35611",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:addressable_project:addressable:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "2.3.0",
              "versionEndExcluding": "2.9.0",
              "matchCriteriaId": "0182812A-1858-487B-8F56-AF6DA7C4D951"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}