CVE-2026-35611

What it actually does

CVE-2026-35611 is a denial-of-service vulnerability in the Ruby Addressable gem’s URI template implementation, affecting versions 2.3.0 through versions before 2.9.0. Certain URI templates generate unsafe regular expressions that are vulnerable to catastrophic backtracking. Templates using the explode modifier, such as {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, or {&var*}, can create nested unbounded quantifiers with exponential worst-case matching behavior. Templates using multiple variables with the + or # operators, such as {+v1,v2,v3}, can create polynomial worst-case matching behavior because separator characters are ambiguously included in matched character classes. If an application matches attacker-controlled URI input against one of these generated regular expressions, CPU usage can spike and request-processing threads or workers can be exhausted, causing service degradation or outage.

Why it matters to the business

An unauthenticated remote attacker may be able to make affected Ruby services slow down or become unavailable by sending specially crafted URI input to application paths that use vulnerable Addressable URI templates. The impact is primarily availability: customer-facing APIs, web applications, background workers, integrations, or routing/validation components may become unresponsive under relatively low request volume if vulnerable templates are exposed. Although this issue has a high availability CVSS score of 7.5, it is not currently listed in CISA KEV, has low EPSS at 0.0036, and has no reported public exploit maturity in the provided data, so remediation should be prioritized for internet-facing or high-throughput Ruby applications that depend on Addressable rather than treated as confirmed active exploitation.

How an attack unfolds

An attacker first identifies an application endpoint or workflow that accepts URI-like input and processes it through Addressable URI templates. The vulnerable condition depends on the application using Addressable versions from 2.3.0 to before 2.9.0 and compiling templates that include either explode modifiers or multiple variables with the + or # operators. The attacker then submits a deliberately crafted URI string designed to nearly match the generated regular expression while forcing the regex engine to explore a very large number of backtracking paths. Because the generated pattern has exponential or high-polynomial complexity for these cases, a single request can consume excessive CPU time. Repeated requests can tie up web workers, application threads, or background jobs, resulting in request timeouts, elevated latency, autoscaling events, or complete service unavailability. The attack does not require authentication, privileges, or user interaction if the affected URI processing is reachable over the network.

How to fix it

Upgrade the Addressable Ruby gem to version 2.9.0 or later. If Addressable is pulled in transitively through another gem, update the top-level dependency and regenerate the lockfile so the resolved Addressable version is no longer in the affected range. For Bundler-managed projects, run an update constrained to Addressable where possible, then verify Gemfile.lock resolves addressable to 2.9.0 or later. If immediate upgrade is not possible, reduce exposure by avoiding vulnerable URI templates that use explode modifiers or multi-variable +/# operators, placing strict length limits on URI-like inputs, applying request timeouts, rate limiting unauthenticated endpoints, and isolating expensive URI-template matching from request-critical execution paths. These mitigations reduce risk but should not be considered a substitute for upgrading.

How to confirm the fix worked

Confirm that all deployed Ruby applications resolve the Addressable gem to version 2.9.0 or later, including transitive dependencies and container images. Review Gemfile.lock, gemspec files, Software Bill of Materials, and runtime gem inventories for addressable versions >= 2.3.0 and < 2.9.0. Search application code for Addressable::Template usage and for templates containing explode modifiers such as {*} patterns or multi-variable +/# operators. Validate the fix in staging by replaying representative URI-template matching workloads with long non-matching inputs and confirming CPU usage remains bounded and requests complete within normal timeout thresholds. For production validation, confirm newly built artifacts contain the fixed gem version and that no older containers, serverless packages, or background worker images remain deployed.

Typical attack path

1. Identify Ruby applications or APIs that use the Addressable gem for URI template matching or URI validation.
2. Find endpoints that accept attacker-controlled URI, URL, path, callback, webhook, redirect, or template-related input.
3. Determine whether exposed code paths use vulnerable URI templates containing explode modifiers or multi-variable + or # operators.
4. Send a crafted long URI string that causes catastrophic regex backtracking during template matching.
5. Repeat or parallelize requests to consume CPU and exhaust application workers.
6. Cause elevated latency, timeouts, failed health checks, degraded service, or full denial of service.

How to detect it

To determine whether exploitation may have occurred, review application access logs, API gateway logs, load balancer logs, WAF logs, and application performance monitoring data for bursts of requests containing unusually long URI, URL, callback, redirect, webhook, or path-like parameters followed by elevated CPU usage, request timeouts, 5xx errors, or worker restarts. Focus on endpoints that invoke Addressable::Template matching or URL validation. In application logs, look for request durations that are much longer than baseline without corresponding database or downstream-service latency. In infrastructure telemetry, correlate high CPU saturation in Ruby, Puma, Unicorn, Passenger, Sidekiq, Resque, or other Ruby worker processes with repeated malformed or very long URI inputs from the same source IPs or user agents. Because this is a resource-exhaustion flaw, exploitation may leave limited artifacts beyond performance degradation, timeout messages, and abnormal request patterns. There are no unique attacker tools or payload strings universally associated with this vulnerability from the provided data.

• Addressable::Template
• addressable (2.3.
• addressable (2.4.
• addressable (2.5.
• addressable (2.6.
• addressable (2.7.
• addressable (2.8.
• {foo*}
• {+var*}
• {#var*}
• {/var*}
• {.var*}
• {;var*}
• {?var*}
• {&var*}
• {+v1,v2,v3}
• Rack::Timeout::RequestTimeoutException
• Net::ReadTimeout
• execution expired
• worker timeout
• PumaWorkerKiller
• SIGKILL
• SIGTERM
• status=500
• status=502
• status=503
• status=504

What your security team should do

• Inventory Ruby applications, containers, and serverless packages for the Addressable gem, prioritizing internet-facing services and APIs that process user-supplied URLs or URI paths.
• Upgrade Addressable to version 2.9.0 or later and redeploy all affected workloads, including background workers and jobs that may process external URLs asynchronously.
• Search code for Addressable::Template usage and review templates with explode modifiers or multi-variable +/# operators to identify reachable high-risk paths.
• Add or verify input length limits, application request timeouts, worker execution timeouts, and rate limits on endpoints that accept URL, URI, redirect, callback, webhook, or path-like input.
• Monitor for CPU spikes, request timeouts, and repeated long URI-like inputs while remediation is in progress.
• Ensure dependency scanning and SBOM tooling flag Addressable versions 2.3.0 through before 2.9.0 as vulnerable.
• Because there is no KEV listing, no ransomware association, low EPSS, and no known exploit maturity in the supplied data, prioritize based on exposure and availability criticality rather than emergency incident response unless suspicious activity is observed.