CVE-2026-35611: 
Ruby vulnerability analysis and mitigation

CVE-2026-35611 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Addressable Ruby gem's URI template implementation. It affects Addressable versions >= 2.3.0 and < 2.9.0 (the earliest installable release is 2.3.2, as 2.3.0 and 2.3.1 were yanked). The vulnerability was discovered in collaboration with researcher @jamfish, published by the maintainer on April 4, 2026, and registered in the NVD on April 7, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Sporkmonger Advisory).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity), manifesting in two distinct patterns within Addressable's URI template matching logic. First, templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate regex patterns with nested unbounded quantifiers, producing O(2^n) worst-case complexity. Second, templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) produce O(n^k) complexity because the comma separator falls within the matched character class, causing ambiguous backtracking across k variables. An unauthenticated remote attacker can trigger catastrophic backtracking by supplying a maliciously crafted URI to any application endpoint that calls Template#match or Template#extract against user-supplied input. Exploitability is highest on MRI Ruby < 3.2 and on all versions of JRuby and TruffleRuby, which lack the Onigmo memoization introduced in MRI Ruby 3.2 (Sporkmonger Advisory, GitHub Advisory).

Successful exploitation causes uncontrolled CPU resource consumption on the affected server, rendering the application unresponsive and resulting in a denial of service (DoS) for legitimate users. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications that use Addressable solely for URI parsing (not URI template matching) are unaffected, but any Ruby application using Template#match or Template#extract with user-controlled input is at risk, including downstream IBM products such as Aspera Faspex, Aspera Shares, API Connect, CloudPak for AIOps, Db2 Warehouse on Cloud Pak for Data, and IBM License Metric Tool (GitHub Advisory, IBM Aspera Faspex).

1. Reconnaissance: Identify Ruby applications that use the Addressable gem (versions 2.3.2–2.8.x) for URI template matching, particularly those exposing HTTP endpoints that pass user-supplied URI strings to Template#match or Template#extract.
2. Identify vulnerable template patterns: Determine whether the target application uses URI templates with the * (explode) modifier (e.g., {foo*}, {+var*}) or multi-variable +/# operators (e.g., {+v1,v2,v3}) in its routing or URL matching logic.
3. Craft malicious URI: Construct a URI string specifically designed to trigger catastrophic backtracking against the identified template pattern — for example, a long string of repeated characters that forces the regex engine into exponential or polynomial backtracking (e.g., a string of repeated / or %2F sequences for explode-modifier templates).
4. Send repeated requests: Submit the crafted URI to the vulnerable endpoint repeatedly or in parallel to maximize CPU exhaustion on the target server.
5. Achieve DoS: The server's Ruby process becomes CPU-bound processing the malicious regex match, causing legitimate requests to time out or fail, effectively taking the application offline (Sporkmonger Advisory, GitHub Advisory).

• Process: Ruby worker processes (e.g., Puma, Unicorn, Passenger) consuming 100% CPU for extended periods with no corresponding increase in legitimate traffic.
• Logs: Application logs showing requests to URI-template-matched routes with unusually long or repetitive URI strings; requests that never complete or time out at the application layer.
• Network: High volume of HTTP requests to specific endpoints from one or a small number of source IPs, particularly with URIs containing long repeated character sequences (e.g., repeated /, %2F, or comma-delimited segments).
• Application Behavior: Increased response latency or complete unresponsiveness of the Ruby application; worker process restarts triggered by timeout mechanisms.

The definitive fix is to upgrade the Addressable gem to version 2.9.0, which fully remediates both vulnerable template pattern classes (Sporkmonger Advisory). Version 2.8.10 provides a partial fix for certain explode-modifier combinations but does not address the multi-variable +/# operator case. If immediate patching is not possible, the following workarounds should be applied:

• Avoid using vulnerable template patterns ({foo*}, {+var*}, {+v1,v2,...}, etc.) when matching user-supplied input.
• Apply a short timeout around any call to Template#match or Template#extract that processes user-controlled data.
• Upgrade to MRI Ruby 3.2 or later as a partial mitigation for the explode-modifier pattern (does not protect against the multi-variable case).
• Implement rate limiting on endpoints that perform URI template matching.

IBM has issued separate advisories for affected products including Aspera Faspex, Aspera Shares, API Connect, CloudPak for AIOps, Db2 Warehouse on Cloud Pak for Data, and IBM License Metric Tool (IBM Aspera Faspex, IBM CloudPak AIOps).

The vulnerability was discovered in collaboration with researcher @jamfish and disclosed responsibly through GitHub's security advisory process (Sporkmonger Advisory). Microsoft acknowledged the vulnerability in its Security Response Center, and IBM issued multiple security bulletins covering affected enterprise products. No significant broader media coverage or notable social media discussion has been identified beyond standard CVE tracking and vendor advisory channels.