The vulnerability exists in the addressable library's URI template implementation where certain templates generate regular expressions prone to catastrophic backtracking. Specifically, templates using the explode modifier (*) with any expansion operator produce nested unbounded quantifiers with exponential (O(2^n)) complexity. Additionally, templates with multiple variables using + or # operators generate patterns with polynomial (O(n^k)) complexity due to ambiguous backtracking caused by the comma separator within the matched character class. This inefficient regex processing can cause excessive CPU consumption and denial of service when matched against crafted URIs. The issue affects versions from 2.3.0 up to but not including 2.9.0 and is resolved in 2.9.0.

Exploitation of this vulnerability can cause denial of service through uncontrolled resource consumption (CPU exhaustion) due to catastrophic backtracking in regular expression matching. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication by supplying maliciously crafted URIs to affected versions of the addressable library.

This vulnerability is fixed in addressable version 2.9.0. Users should upgrade to version 2.9.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated beyond the fix in 2.9.0; therefore, verify with the vendor advisory for the most current remediation guidance.