Addressable has a Regular Expression Denial of Service in Addressable templates

Impact Within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking: 1. Templates using the explode modifier with any expansion operator e.g., foo, +var, var, /var, .var, ;var, ?var, &var generate patterns...

EUVD-2026-19788

Addressable has a Regular Expression Denial of Service in Addressable templates...

OPENSUSE-SU-2026:10508-1 ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-35611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI...

CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

DEBIAN-CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

UBUNTU-CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

CVE-2026-35611 Addressable has a Regular Expression Denial of Service in Addressable templates

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

CVE-2026-35611

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

PT-2026-30806

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.1 Description Rack::Session is a session management implementation for Rack. Versions 2.0.0 through 2.1.1 incorrectly handle decryption failures when configured with secrets. If cookie decryption fails,...

CVE-2026-35611: Inefficient Regular Expression Complexity

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking...

Addressable security vulnerabilities

Addressable is a Ruby library developed by Bob Aman. Versions of Addressable from 2.3.0 to 2.9.0 contained a security vulnerability. This vulnerability stemmed from the URI template implementation; two types of regular expressions generated by the URI templates had catastrophic backtracking, whic...

CVE-2026-34829 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, pact-broker-docker, ruby3.2-rack, ruby3.4-rack, gitlab-cng, logstash, ruby3.4-rails, kube-fluentd-operator, ruby3.3-rack, gitlab-rails-ce, pact-broker-docker-fips, ruby4.0-rack, ruby3.2-rails...

CVE-2026-34827 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, logstash, kube-fluentd-operator, pact-broker-docker-fips, ruby3.2-rails...

CVE-2026-34835 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, logstash, kube-fluentd-operator, pact-broker-docker-fips, ruby3.2-rails...

GHSA-V6X5-CG8R-VV6X vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, logstash, kube-fluentd-operator, pact-broker-docker-fips, ruby3.2-rails...

CVE-2026-26961 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, pact-broker-docker, ruby3.2-rack, ruby3.4-rack, gitlab-cng, logstash, ruby3.4-rails, kube-fluentd-operator, ruby3.3-rack, gitlab-rails-ce, pact-broker-docker-fips, ruby4.0-rack, ruby3.2-rails...

CVE-2026-34230 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, pact-broker-docker, ruby3.2-rack, ruby3.4-rack, gitlab-cng, logstash, ruby3.4-rails, kube-fluentd-operator, ruby3.3-rack, gitlab-rails-ce, pact-broker-docker-fips, ruby4.0-rack, ruby3.2-rails...