Threats tagged 'brew-mikutter-cve-2026-126350'

Addressable versions from 2.3.0 (excluding yanked 2.3.0 and 2.3.1) through 2.9.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in URI template matching when using the explode (*) modifier with certain operators. This flaw causes catastrophic backtracking in regex matching, leading to exponential processing time and denial of service when matching maliciously crafted URIs. The issue affects Ruby implementations with non-memoizing regex engines such as MRI Ruby versions before 3.2 and JRuby. It is fixed in Addressable 2.9.1 and in MRI Ruby 3.2 and later. Users only expanding templates or using URI parsing without template matching are not impacted.