Answer in brief
CVE-2026-126351 records a Medium severity (CVSS 5.9) vulnerability in Addressable: Denial of service in URI path normalization. The current sources do not mark it as known exploited. The current feed maps sporkmonger/addressable (generic), addressable (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps sporkmonger/addressable (generic), addressable (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| sporkmonger/addressablegeneric | <2.9.1 | 2.9.1 |
| addressablerubygems | <2.9.1 | 2.9.1 |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1.
Quoted source text, attributed separately from HOL analysis.