Addressable CVE-2026-35611

Requires Addressable gem versions 2.3.0 through 2.8.x in Ruby applications. Remote unauthenticated attacker can trigger ReDoS by crafting malicious URIs matching URI templates with * (explode) modifier or multiple variables. No victim interaction needed.

The CVSS 3.1 score of 7.5 (High) reflects significant availability impact with favorable attacker conditions: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The vulnerability strictly affects availability (A:H) with no confidentiality or integrity impact, making this a pure denial-of-service issue. Real-world risk is moderate to high for internet-facing Ruby applications that process untrusted URIs through Addressable templates, particularly API endpoints, web proxies, or URL validation services. The attack is easily automatable given the deterministic nature of ReDoS exploitation-attackers need only craft URIs matching vulnerable template patterns to consume CPU resources. However, exploitation requires the application to actively use URI template expansion features with the specific vulnerable patterns (explode modifiers or multi-variable reserved operators), which may limit attack surface in practice. No public exploit identified at time of analysis, and absence of EPSS/KEV data suggests this has not been widely weaponized in the wild, though the technical barrier to exploitation is low. The SSVC framework would likely classify this as Medium priority: exploitation is probable (simple ReDoS), automatable (yes), but technical impact limited to resource consumption rather than compromise. Organizations using affected Addressable versions for URI processing should prioritize patching, especially for public-facing services.

An attacker identifies a public API endpoint that uses Addressable for URI template matching, such as a REST API implementing RFC 6570 templated routes like /api/{+path*}/resource. The attacker crafts a malicious URI with a deeply nested structure designed to trigger catastrophic backtracking, such as /api/ followed by hundreds of characters matching the vulnerable pattern (e.g., repeating sequences exploiting the nested quantifiers in explode modifier patterns). Submitting this URI causes the application's regex engine to enter exponential-time backtracking, consuming CPU resources for seconds or minutes per request. By sending concurrent requests with such payloads, the attacker exhausts available CPU on application servers, rendering the service unresponsive to legitimate users. No public exploit identified at time of analysis, but the attack technique is well-documented in ReDoS literature and requires only HTTP client access.