PT-2026-146073

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URInormalize,...

PT-2026-146076

Summary Addressable::URI.normalize path resolves some paths containing .. segments to a different path than RFC 3986 does. When a path climbs above the root before any other .. is resolved, the segments that later .. segments should remove are instead kept: /../../public/x/../../secret normalizes...