Threats tagged 'brew-travis-cve-2026-126350'

Addressable versions from 2.3.0 (excluding yanked 2.3.0 and 2.3.1) through 2.9.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in URI template matching when using the explode modifier (*) with certain operators. This flaw causes catastrophic backtracking in regex matching, leading to exponential processing time and denial of service when maliciously crafted URIs are matched. The issue is fixed in version 2.9.1. Ruby MRI versions prior to 3.2 and JRuby are vulnerable due to their regex engines lacking backtracking memoization, while MRI 3.2+ and TruffleRuby 40.0 are not affected. Users only expanding templates or not using template matching are unaffected.