Threats tagged 'brew-asciidoctor-cve-2026-126352'

Addressable versions from 2.3.0 (excluding yanked 2.3.0 and 2.3.1) through 2.9.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in URI template matching. This occurs when templates use multiple variables in one expression or several single-variable expressions adjacent to each other, causing excessive backtracking in the regex engine. The vulnerability affects Ruby implementations with backtracking regex engines such as MRI Ruby before 3.3, JRuby, and TruffleRuby 40.0. It can lead to denial of service by consuming excessive CPU resources when matching crafted URIs. The issue is fixed in Addressable 2.9.1 and MRI Ruby 3.3 or later.