--- title: GHSA-9f42-57jx-vpp3 (addressable): Regular Expression... description: The Ruby gem Addressable has a regular expression denial of service flaw in its URI template matching. Templates with multiple variables in one expression,... canonical: https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-9f42-57jx-vpp3 (addressable): Regular Expression Denial of Service in Addressable templates with multiple variables | daily.dev og:description: The Ruby gem Addressable has a regular expression denial of service flaw in its URI template matching. Templates with multiple variables in one expression,... og:url: https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o og:image: https://api.daily.dev/og/posts/VCOiX5Q1O.png og:image:alt: GHSA-9f42-57jx-vpp3 (addressable): Regular Expression Denial of Service in Addressable templates with multiple variables og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-9f42-57jx-vpp3 (addressable): Regular Expression Denial of Service in Addressable templates with multiple variables **[RUBYLAND](https://daily.dev/sources/rubyla)** · 2 min read · 0 upvotes · 0 comments ## Summary The Ruby gem Addressable has a regular expression denial of service flaw in its URI template matching. Templates with multiple variables in one expression, like {/owner,repo,ref}, generate regexes prone to excessive backtracking. A three-variable path template needs only about 2 KB of crafted input to occupy a thread for many seconds. The bug affects Template#match and Template#extract; Template#expand and plain URI parsing are unaffected. It's rated CVSS 5.9 (medium) and patched in Addressable 2.9.1 and later. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the Addressable gem's Template#match vulnerable to a regular expression denial of service? Yes, Addressable versions before 2.9.1 are vulnerable to ReDoS when Template#match or Template#extract process URI templates with multiple variables in one expression, such as {/owner,repo,ref}. A three-variable path template needs only about 2 KB of crafted input to occupy a thread for many seconds. Users who only call Template#expand or use plain URI parsing are unaffected. _Teams auditing Ruby dependencies for ReDoS risk can track advisories like this one on daily.dev._ ### How do I fix the Addressable ReDoS vulnerability GHSA-9f42-57jx-vpp3? Upgrade the addressable gem to version 2.9.1 or later, which patches the regular expression denial of service in URI template matching. Versions before 2.3.0 are unaffected by this specific issue, but anything between 2.3.0 and 2.9.0 should be updated to 2.9.1. _daily.dev helps developers stay on top of gem patch releases like this Addressable fix._ ### What causes exponential backtracking in URI templates with multiple variables like {+v1,v2,v3}? Expressions joining several variables with an optional separator allow a run of characters to be split among the variables in O(n^k) ways for k variables, causing catastrophic backtracking. For the + or # operators with many variables, a failing match becomes exponential in variable count, while adjacent single-variable expressions like {+a}{+b}{+c} are polynomial instead. _Developers debugging regex performance issues can follow writeups like this on daily.dev._ ## Similar posts on daily.dev - [GHSA-4w5q-wg7v-w6gp \(addressable\): Regular Expression Denial of Service in Addressable templates with several exploded variables](https://daily.dev/posts/ghsa-4w5q-wg7v-w6gp-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-ecd8aibab) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-j82w-28jv-3pmj \(addressable\): Regular Expression Denial of Service in Addressable templates with certain exploded expressions](https://daily.dev/posts/ghsa-j82w-28jv-3pmj-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-m0z9njray) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-qq38-m9mg-xjj5 \(addressable\): Denial of service in Addressable URI path normalization](https://daily.dev/posts/ghsa-qq38-m9mg-xjj5-addressable-denial-of-service-in-addressable-uri-path-normalization-swecc9der) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-8gmh-2hhj-2hv9 \(addressable\): Addressable URI normalization resolves some dotted path segments to the wrong path](https://daily.dev/posts/ghsa-8gmh-2hhj-2hv9-addressable-addressable-uri-normalization-resolves-some-dotted-path-segments--v6olloi8z) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-9f42-57jx-vpp3 (addressable): Regular Expression Denial of Service in Addressable templates with multiple variables","url":"https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o"},"datePublished":"2026-11-01T15:23:14.351Z","dateModified":"2026-11-01T15:23:38.368Z","description":"The Ruby gem Addressable has a regular expression denial of service flaw in its URI template matching. Templates with multiple variables in one expression,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-9f42-57jx-vpp3 (addressable): Regular Expression Denial of Service in Addressable templates with multiple variables"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-9f42-57jx-vpp3-addressable-regular-expression-denial-of-service-in-addressable-templates-wit-vcoix5q1o#faq","mainEntity":[{"@type":"Question","name":"Is the Addressable gem's Template#match vulnerable to a regular expression denial of service?","acceptedAnswer":{"@type":"Answer","text":"Yes, Addressable versions before 2.9.1 are vulnerable to ReDoS when Template#match or Template#extract process URI templates with multiple variables in one expression, such as {/owner,repo,ref}. A three-variable path template needs only about 2 KB of crafted input to occupy a thread for many seconds. Users who only call Template#expand or use plain URI parsing are unaffected. Teams auditing Ruby dependencies for ReDoS risk can track advisories like this one on daily.dev."}},{"@type":"Question","name":"How do I fix the Addressable ReDoS vulnerability GHSA-9f42-57jx-vpp3?","acceptedAnswer":{"@type":"Answer","text":"Upgrade the addressable gem to version 2.9.1 or later, which patches the regular expression denial of service in URI template matching. Versions before 2.3.0 are unaffected by this specific issue, but anything between 2.3.0 and 2.9.0 should be updated to 2.9.1. daily.dev helps developers stay on top of gem patch releases like this Addressable fix."}},{"@type":"Question","name":"What causes exponential backtracking in URI templates with multiple variables like {+v1,v2,v3}?","acceptedAnswer":{"@type":"Answer","text":"Expressions joining several variables with an optional separator allow a run of characters to be split among the variables in O(n^k) ways for k variables, causing catastrophic backtracking. For the + or # operators with many variables, a failing match becomes exponential in variable count, while adjacent single-variable expressions like {+a}{+b}{+c} are polynomial instead. Developers debugging regex performance issues can follow writeups like this on daily.dev."}}]} ```