Threats affecting pkg:brew/asciidoctor

Addressable versions from 2.3.0 (excluding yanked 2.3.0 and 2.3.1) through 2.9.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in URI template matching. This occurs when templates use multiple variables in one expression or several single-variable expressions adjacent to each other, causing excessive backtracking in the regex engine. The vulnerability affects Ruby implementations with backtracking regex engines such as MRI Ruby before 3.3, JRuby, and TruffleRuby 40.0. It can lead to denial of service by consuming excessive CPU resources when matching crafted URIs. The issue is fixed in Addressable 2.9.1 and MRI Ruby 3.3 or later.

Addressable versions from 2.3.0 (excluding yanked 2.3.0 and 2.3.1) through 2.9.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in URI template matching when using the explode (*) modifier with certain operators. This causes catastrophic backtracking on malicious inputs, leading to denial of service by consuming excessive CPU time. The issue is fixed in version 2.9.1. The vulnerability affects Ruby implementations with non-memoizing regex engines such as MRI Ruby before 3.2 and JRuby, but not MRI Ruby 3.2+ or TruffleRuby 40.0. Users only using template expansion or URI parsing without matching are not affected.