GHSA-QQ38-M9MG-XJJ5 Addressable: Denial of service in URI path normalization

Impact Addressable::URI.normalizepath takes time quadratic in the number of nested dot segments in a path e.g., "/" + "a/" n + "../" n, which for n = 3 is /a/a/a/../../../, because it removes one dot segment per pass over the whole path. URInormalize, URInormalizedpath, URI==, URI=== and URIjoin...

Addressable URI normalization resolves some dotted path segments to the wrong path

Summary Addressable::URI.normalizepath resolves some paths containing .. segments to a different path than RFC 3986 does. When a path climbs above the root before any other .. is resolved, the segments that later .. segments should remove are instead kept: /../../public/x/../../secret normalizes ...

GHSA-8GMH-2HHJ-2HV9 Addressable URI normalization resolves some dotted path segments to the wrong path

Summary Addressable::URI.normalizepath resolves some paths containing .. segments to a different path than RFC 3986 does. When a path climbs above the root before any other .. is resolved, the segments that later .. segments should remove are instead kept: /../../public/x/../../secret normalizes ...

CVE-2026-126351

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalizepath repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URInormalize,...

CVE-2026-126354

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalizepath can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver...

CVE-2026-126354 Addressable URI normalization resolves some dotted path segments to the wrong path

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalizepath can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver...

CVE-2026-126354

The Addressable library (versions 2.2.5 through 2.9.1 ) contains a URI normalization vulnerability where Addressable::URI.normalize_path resolves paths with leading or subsequent parent segments differently than an RFC 3986 resolver. This discrepancy affects URI#normalize , URI#join , URI#== , an...

CVE-2026-126354: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalizepath can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver...

CVE-2026-126351: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalizepath repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URInormalize,...