CVE-2026-35611 Addressable has a Regular Expression Denial of Service in Addressable templates
Attackers can cause denial of service in applications using Addressable by submitting malicious URIs that trigger catastrophic backtracking in URI template regexes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35611?
CVE-2026-35611 is a high-severity denial of service vulnerability in sporkmonger addressable, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.
Weakness: CWE-1333
Which versions are affected by CVE-2026-35611?
2 open source packages ship an affected version, including addressable. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
addressable RubyGems | From 2.3.0 | 2.9.0 |
addressable RubyGems | From 2.3.0 | 2.9.0 |
Products include Addressable Project Addressable.
How do I fix CVE-2026-35611?
Upgrade addressable to 2.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35611 being exploited?
There is no known exploitation of CVE-2026-35611 in the wild and no public exploit code.
Other vulnerabilities in sporkmonger addressable
Sources
Also known as AZL-82061, DEBIAN-CVE-2026-35611, GHSA-h27x-rffw-24p4, MINI-29c2-cwwf-rg25, MINI-2m2f-hfp2-84w9, MINI-3434-m2rw-cfp6 and 22 more.