Threats tagged 'ghsa-j82w-28jv-3pmj'

Addressable versions from 2.3.0 up to but not including 2.9.1 contain a Regular Expression Denial of Service (ReDoS) vulnerability in URI templates that use the explode (*) modifier with certain operators. This vulnerability causes catastrophic backtracking when matching maliciously crafted URIs, leading to exponential processing time and denial of service. The issue is fixed in version 2.9.1. Ruby MRI versions prior to 3.2 and JRuby are vulnerable, while MRI 3.2+ and TruffleRuby 40.0 are not affected.