# CVE-2026-35611: Addressable has a Regular Expression Denial of Service in Addressable templates

CVE-2026-35611 is fixed in ruby-addressable on 1 platform, first by ruby-addressable 2.5.2-1ubuntu0.1~esm1, released April 7, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-35611
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0037
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 7, 2026
- Weakness: Inefficient Regular Expression Complexity
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35611

## Description

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | ruby-addressable Debian 14 | 2.9.0-1 | [DEBIAN-CVE-2026-35611](https://patchblox.com/security/data/fix/linux/debian-cve-2026-35611.md) | Apr 7, 2026 |
| Linux | ruby-addressable Ubuntu 18.04.6 LTS (bionic) | 2.5.2-1ubuntu0.1~esm1 | [ruby-addressable 2.5.2-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ruby-addressable-2.5.2-1ubuntu0.1-esm1.md) | Apr 7, 2026 |
| Linux | ruby-addressable Ubuntu 20.04 LTS (focal) | 2.7.0-1ubuntu0.1~esm1 | [ruby-addressable 2.7.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-ruby-addressable-2.7.0-1ubuntu0.1-esm1.md) | Apr 7, 2026 |
| Linux | ruby-addressable Ubuntu 22.04.1 LTS (jammy) | 2.8.0-3ubuntu0.1~esm1 | [ruby-addressable 2.8.0-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ruby-addressable-2.8.0-3ubuntu0.1-esm1.md) | Apr 7, 2026 |
| Linux | ruby-addressable Ubuntu 24.04.5 LTS (noble) | 2.8.5-1ubuntu0.1~esm1 | [ruby-addressable 2.8.5-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ruby-addressable-2.8.5-1ubuntu0.1-esm1.md) | Apr 7, 2026 |
| Linux | ruby-addressable Ubuntu 26.04.1 LTS (resolute) | 2.8.7-2ubuntu0.26.04.1~esm1 | [ruby-addressable 2.8.7-2ubuntu0.26.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ruby-addressable-2.8.7-2ubuntu0.26.04.1-esm1.md) | Apr 7, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.