Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables. When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. This vulnerability is fixed in 2.9.0.

An update of the rubygem package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8515-1 advisory.

    It was discovered that Addressable incorrectly handled certain URI templates, generating regular     expressions vulnerable to catastrophic backtracking. An attacker could use this issue to craft a URI that,     when matched against a vulnerable template, causes excessive resource consumption, leading to a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard
    library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of
    URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the *
    (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*},
    {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against
    a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g.,
    {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched
    character class, causing ambiguous backtracking across k variables. When matched against a maliciously
    crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading
    to denial of service. This vulnerability is fixed in 2.9.0. (CVE-2026-35611)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014268 advisory.

    Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard     library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of     URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the *     (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*},     {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against     a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g.,     {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched     character class, causing ambiguous backtracking across k variables. When matched against a maliciously     crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading     to denial of service. This vulnerability is fixed in 2.9.0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard     library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of     URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the *     (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*},     {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against     a maliciously crafted URI. Templates using multiple variables with the + or # operators (e.g.,     {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched     character class, causing ambiguous backtracking across k variables. When matched against a maliciously     crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading     to denial of service. This vulnerability is fixed in 2.9.0. (CVE-2026-35611)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328954	Photon OS 5.0: Rubygem PHSA-2026-5.0-0855	Nessus	PhotonOS Local Security Checks	high
325648	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Addressable vulnerability (USN-8515-1)	Nessus	Ubuntu Local Security Checks	high
312348	Photon OS 4.0: Rubygem PHSA-2026-4.0-1005	Nessus	PhotonOS Local Security Checks	high
312347	Photon OS 5.0: Rubygem PHSA-2026-5.0-0835	Nessus	PhotonOS Local Security Checks	high
441053	Alpine: ruby-addressable: security update to 2.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
441053	Alpine: ruby-addressable: security update to 2.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
310016	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rubygem-addressable (UTSA-2026-014268)	Nessus	Unity Linux Local Security Checks	high
440012	SCA: security update for addressable (GHSA-h27x-rffw-24p4)	Tenable Cloud Security	SCA Checks	high
440012	SCA: security update for addressable (GHSA-h27x-rffw-24p4)	Tenable Self-Hosted Container Security	SCA Checks	high
305616	Linux Distros Unpatched Vulnerability : CVE-2026-35611	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35611

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high