The vulnerability exists in the addressable library's URI template implementation where certain templates generate regular expressions with nested unbounded quantifiers or ambiguous backtracking patterns. Specifically, templates using the explode modifier (*) with any expansion operator produce patterns with exponential (O(2^n)) complexity, and templates with multiple variables using + or # operators produce polynomial (O(n^k)) complexity. When matched against maliciously crafted URIs, these patterns cause catastrophic backtracking, resulting in denial of service due to excessive resource consumption. The issue affects versions from 2.3.0 to before 2.9.0 and is resolved in version 2.9.0.

Exploitation of this vulnerability can cause denial of service by triggering catastrophic backtracking in regular expression matching within the addressable library. This leads to uncontrolled CPU resource consumption and potential application unavailability. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.

This vulnerability is fixed in addressable version 2.9.0. Users should upgrade to version 2.9.0 or later to remediate the issue. Since the vendor advisory indicates the fix is available in 2.9.0, upgrading is the recommended mitigation. No other vendor advisory or patch links are provided, so patch status beyond this upgrade is not confirmed. Patch status is considered fixed in 2.9.0.