Threats tagged 'ghsa-qq38-m9mg-xjj5'

A denial of service vulnerability exists in the Addressable Ruby gem's URI path normalization function. The function Addressable::URI.normalize_path has quadratic time complexity relative to the number of nested dot segments in a URI path, causing excessive CPU consumption when normalizing, comparing, or joining crafted URIs. This affects all Addressable versions prior to 2.9.1 and impacts all Ruby implementations including MRI Ruby 3.2 and later. The issue is fixed in version 2.9.1.