Threats tagged 'brew-krane-cve-2026-126351'

A denial of service vulnerability exists in the Addressable Ruby gem's URI path normalization function. The function Addressable::URI.normalize_path has quadratic time complexity relative to the number of nested dot segments in a URI path, causing excessive CPU consumption when processing crafted input. This affects all versions prior to 2.9.1 and impacts all Ruby implementations including MRI Ruby 3.2 and later. The vulnerability can be triggered by normalizing, comparing, or joining URIs derived from untrusted sources. The issue is fixed in version 2.9.1.