Seven new addressable advisories

gems/addressable/GHSA-4w5q-wg7v-w6gp.yml

@@ -0,0 +1,39 @@
+---
+gem: addressable
+ghsa: 4w5q-wg7v-w6gp
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-4w5q-wg7v-w6gp
+title: Regular Expression Denial of Service in Addressable templates
+  with several exploded variables
+date: 2026-10-30
+description: |
+  Within the URI template implementation in Addressable, expressions
+  with several exploded variables (e.g., {+a*,b*}, {+a*,b*,c*},
+  {/a*,b*}, {?a*,b*}) generate regular expressions vulnerable to
+  excessive backtracking. A run of members can be divided among the
+  exploded variables in O(n^k) ways for k variables. When Template#match
+  or Template#extract is called with a maliciously crafted URI, this
+  can result in uncontrolled resource consumption, leading to denial
+  of service. With 2.9.0, {+a*,b*,c*} takes over 12 seconds to reject
+  1 KB of input on MRI Ruby 3.2.
+
+  Users of the URI parsing capabilities in Addressable but not the
+  URI template matching capabilities are unaffected. Users who only
+  call Template#expand are unaffected.
+
+  ## Credits
+
+  Reported by Daniel Coles (@manus-pi).
+cvss_v3: 5.9
+unaffected_versions:
+  - "< 2.3.0"
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-4w5q-wg7v-w6gp
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.

gems/addressable/GHSA-539f-xcgw-2gjg.yml

@@ -0,0 +1,48 @@
+---
+gem: addressable
+ghsa: 539f-xcgw-2gjg
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg
+title: Addressable display_uri can show misleading hosts
+  containing bidi and invisible characters
+date: 2026-10-30
+description: |
+  Addressable::IDNA.to_unicode decodes Punycode labels (labels beginning
+  with xn--) that contain characters which change how text is displayed
+  without being visible themselves. These include bidirectional controls
+  such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width
+  characters, and other invisible format characters.
+  Addressable::URI#display_uri uses to_unicode, so it can display a
+  host whose characters appear reordered or which looks identical to
+  a different host. For example, the host of http://xn--abcmoc-dm0c.com/
+  is displayed as abc, U+202E, moc.com, and the override makes
+  everything after abc render right to left.
+
+  Parsing, host, normalized_host and any connection made from the URI
+  are not affected. Only the displayed form is. Applications that
+  show display_uri to users (link previews, chat and email clients,
+  admin interfaces) can be used to make a malicious domain look
+  like a trusted one.
+
+  In the pure-Ruby IDNA implementation, all such characters are
+  decoded, including those that IDNA's nameprep profile prohibits.
+  In the native IDNA implementation, used when libidn and the idn-ruby
+  gem are installed, libidn rejects most of them, but not characters
+  added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.
+
+  ## Credits
+
+  Reported by @andrewstellman.
+cvss_v3: 3.1
+unaffected_versions:
+  - "< 2.0.0"
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.

gems/addressable/GHSA-8gmh-2hhj-2hv9.yml

@@ -0,0 +1,32 @@
+---
+gem: addressable
+ghsa: 8gmh-2hhj-2hv9
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9
+title: Addressable URI normalization resolves some dotted
+  path segments to the wrong path
+date: 2026-10-30
+description: |
+  Addressable::URI.normalize_path resolves some paths containing ..
+  segments to a different path than RFC 3986 does. When a path climbs
+  above the root before any other .. is resolved, the segments that
+  later .. segments should remove are instead kept:
+  /../../public/x/../../secret normalizes to /public/x/secret instead
+  of /secret. URI#normalize, URI#join, URI#== and URI#=== all use
+  this normalization. An application that checks a normalized Addressable
+  path against an allowlist, but sends the original URI to something
+  that resolves it according to RFC 3986, can be made to allow a
+  request for a path outside the allowlist.
+cvss_v3: 4.8
+unaffected_versions:
+  - "< 2.2.5"
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.

gems/addressable/GHSA-9crm-g4mf-wc5j.yml

@@ -0,0 +1,48 @@
+---
+gem: addressable
+ghsa: 9crm-g4mf-wc5j
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j
+title: Addressable display_uri can show misleading hosts with
+  invalid Punycode A-labels
+date: 2026-10-30
+description: |
+  Addressable::IDNA.to_unicode, in the pure-Ruby IDNA implementation,
+  decodes Punycode labels (labels beginning with xn--) that are not
+  valid A-labels. Those labels are returned in decoded form, when
+  they should be returned unchanged. That includes:
+
+  * labels that decode to only ASCII characters, e.g. xn--google-
+    decodes to google;
+  * labels that decode to text that doesn't convert back to the same
+    label (RFC 3490 §4.2), e.g. text that isn't in normalized form.
+
+  Addressable::URI#display_uri uses to_unicode, so for
+  https://xn--google-.example.org/ it displays the host google.example.org,
+  while #host, #normalized_host and any connection made from the URI
+  use xn--google-.example.org. An attacker who controls a domain can
+  therefore have a URI displayed as a host they don't control.
+  Applications that compare the result of to_unicode against a list
+  of trusted names can likewise treat two different hosts as the same.
+
+  The native IDNA implementation, used when libidn and the idn-ruby
+  gem are installed, is not affected. to_ascii and normalized_host
+  are not affected.
+
+  ## Credits
+
+  Reported by @tonghuaroot.
+cvss_v3: 4.3
+unaffected_versions:
+  - "< 2.0.0"
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/advisories/GHSA-mc76-5925-c5p6
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.

gems/addressable/GHSA-9f42-57jx-vpp3.yml

@@ -0,0 +1,51 @@
+---
+gem: addressable
+ghsa: 9f42-57jx-vpp3
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3
+title: Regular Expression Denial of Service in Addressable
+  templates with multiple variables
+date: 2026-10-30
+description: |
+  Within the URI template implementation in Addressable, templates
+  that put several variables in one expression generate regular
+  expressions vulnerable to excessive backtracking:
+
+  1. Expressions with any operator other than + and # (e.g., {/owner,repo,ref},
+     {.a,b}, {a,b,c}, {;a,b,c}). The values are joined by an optional
+     separator, so a run of characters can be divided among the variables
+     in O(n^k) ways for k variables.
+  2. Expressions with the + or # operators and many variables (e.g.,
+     {+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}). A failing match is exponential
+     in the number of variables.
+  3. Several single-variable expressions next to each other (e.g.,
+     {+a}{+b}{+c} or {a}{b}{c}), which are polynomial in the input length.
+
+  When Template#match or Template#extract is called with a maliciously
+  crafted URI, this can result in uncontrolled resource consumption,
+  leading to denial of service. A three-variable path template such
+  as http://example.com/repos{/owner,repo,ref} needs about 2 KB of
+  input to occupy a thread for many seconds.
+
+  Users of the URI parsing capabilities in Addressable but not the
+  URI template matching capabilities are unaffected. Users who only
+  call Template#expand are unaffected.
+
+  ## Credits
+
+  Reported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security.
+cvss_v3: 5.9
+unaffected_versions:
+  - "< 2.3.0"
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/advisories/GHSA-j82w-28jv-3pmj
+    - https://github.com/advisories/GHSA-h27x-rffw-24p4
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.

gems/addressable/GHSA-j82w-28jv-3pmj.yml

@@ -0,0 +1,50 @@
+---
+gem: addressable
+ghsa: j82w-28jv-3pmj
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj
+title: Regular Expression Denial of Service in Addressable
+  templates with certain exploded expressions
+date: 2026-10-30
+description: |
+  Within the URI template implementation in Addressable, templates
+  using the * (explode) modifier with the /, ., ;, ? or & operators
+  (e.g., {/segments*}, {.ext*}, {;params*}, {?query*}) generate
+  regular expressions vulnerable to catastrophic backtracking. When
+  Template#match or Template#extract is called with a maliciously
+  crafted URI that starts with the operator's leading character,
+  matching takes exponential time, leading to uncontrolled resource
+  consumption and denial of service. An input under 60 bytes is
+  enough to occupy a thread for minutes.
+
+  GHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as
+  fully remediated in 2.9.0. The 2.9.0 fix only made the joiner
+  between exploded members mandatory for templates without an operator,
+  and its regression specs used inputs that never start with the
+  operator's leading character, so the vulnerable part of the
+  expression was never reached. This issue was originally reported
+  in #364 by @ebenoist in 2019 but insufficiently investigated.
+
+  Users of the URI parsing capabilities in Addressable but not the
+  URI template matching capabilities are unaffected. Users who
+  only call Template#expand are unaffected.
+
+  ## Credits
+
+  Reported independently by @ebenoist, @andrewstellman, and
+  then @halogenandtoast.
+cvss_v3: 5.9
+unaffected_versions:
+  - "< 2.3.0"
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/sporkmonger/addressable/issues/364
+    - https://github.com/advisories/GHSA-h27x-rffw-24p4
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.

gems/addressable/GHSA-qq38-m9mg-xjj5.yml

@@ -0,0 +1,37 @@
+---
+gem: addressable
+ghsa: qq38-m9mg-xjj5
+url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5
+title: Denial of service in Addressable URI path normalization
+date: 2026-10-30
+description: |
+  Addressable::URI.normalize_path takes time quadratic in the number
+  of nested dot segments in a path (e.g., "/" + "a/" * n + "../" * n,
+  which for n = 3 is /a/a/a/../../../), because it removes one dot
+  segment per pass over the whole path. URI#normalize, URI#normalized_path,
+  URI#==, URI#=== and URI#join all call it. Normalizing, comparing or
+  joining a URI taken from user input can result in uncontrolled
+  resource consumption, leading to denial of service. On 2.9.0,
+  normalizing a 34 KB path takes about 3.5 seconds on MRI Ruby 4.0,
+  and the cost grows with the square of the path length.
+
+  This affects every Ruby implementation, including MRI Ruby 3.2 and
+  later. URI.parse by itself is unaffected, as is code that never
+  normalizes, compares, or joins URIs from untrusted sources.
+
+  ## Credits
+
+  Reported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem
+  Security, who also suggested the single-pass approach used in the fix.
+cvss_v3: 5.9
+patched_versions:
+  - ">= 2.9.1"
+related:
+  url:
+    - https://rubygems.org/gems/addressable/versions/2.9.1
+    - https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
+    - https://github.com/sporkmonger/addressable/compare/addressable-2.9.0...addressable-2.9.1
+    - https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v3 in GHSA URL.