sporkmonger vulnerabilities

Products

• addressable 9

Latest sporkmonger CVEs

Newest publication first

1. CVE-2026-126354 Addressable URI normalization resolves some dotted path segments to the wrong path

   Published 2026-11-12

   Medium·CVSS 4.8 EPSS 0.29%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC...

2. CVE-2026-126353 Addressable: Regular Expression Denial of Service in Addressable templates with several exploded variables

   Published 2026-11-12

   Medium·CVSS 5.9 EPSS 0.31%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the...

3. CVE-2026-126352 Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables

   Published 2026-11-12

   Medium·CVSS 5.9 EPSS 0.43%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms in...

4. CVE-2026-126351 Addressable: Denial of service in URI path normalization

   Published 2026-11-12

   Medium·CVSS 5.9 EPSS 0.41%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#n...

5. CVE-2026-126350 Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions

   Published 2026-11-12

   Medium·CVSS 5.9 EPSS 0.42%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous reg...

6. CVE-2026-126349 Addressable display_uri can show misleading hosts containing bidi and invisible characters

   Published 2026-11-12

   Low·CVSS 3.1 EPSS 0.25%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other...

7. CVE-2026-126348 Addressable display_uri can show misleading hosts with invalid Punycode A-labels

   Published 2026-11-12

   Medium·CVSS 4.3 EPSS 0.27%

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that dec...

8. CVE-2026-35611 Addressable has a Regular Expression Denial of Service in Addressable templates

   Published 2026-04-07

   High·CVSS 7.5 EPSS 0.37% PoC

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic b...

9. CVE-2021-32740 Regular Expression Denial of Service in Addressable templates

   Published 2021-07-06

   High·CVSS 7.5 EPSS 2.1% PoC

   Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciousl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.