CVE-2026-35611

Publication date 7 April 2026

Last updated 7 July 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

Description

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.

Status

Package Ubuntu Release Status
ruby-addressable 26.04 LTS resolute
Fixed 2.8.7-2ubuntu0.26.04.1~esm1
25.10 questing
Needs evaluation
24.04 LTS noble
Fixed 2.8.5-1ubuntu0.1~esm1
22.04 LTS jammy
Fixed 2.8.0-3ubuntu0.1~esm1
20.04 LTS focal
Fixed 2.7.0-1ubuntu0.1~esm1
18.04 LTS bionic
Fixed 2.5.2-1ubuntu0.1~esm1
16.04 LTS xenial Ignored end of ESM support, was needs-triage

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.5 · High

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-8515-1
    • Addressable vulnerability
    • 7 July 2026

Other references

Access our resources on patching vulnerabilities