CVE-2021-32740

RubyGems/addressable CVE-2021-32740: high 7.5, EPSS 2.14%

Regular Expression Denial of Service in Addressable templates

Action: Upgrade addressable to 2.8.0 or later.

bundle update addressable

Affected

Fixed versions

Sources

• osv: GHSA-jxhc-q857-3j6g
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-jxhc-q857-3j6g
• https://nvd.nist.gov/vuln/detail/CVE-2021-32740
• https://github.com/sporkmonger/addressable/commit/0d8a3127e35886ce9284810a7f2438bff6b43cbc
• https://github.com/sporkmonger/addressable/commit/89c76130ce255c601f642a018cb5fb5a80e679a7
• https://github.com/sporkmonger/addressable/commit/92685096b1f7235ed8986c03ce30a24972eed848#diff-fb36d3dc67e6565ffde17e666a98697f48e76dac38fabf1bb9e97cdf3b583d76
• https://github.com/advisories/GHSA-jxhc-q857-3j6g
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/CVE-2021-32740.yml
• https://github.com/sporkmonger/addressable
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDFQM2NHNAZ3NNUQZEJTYECYZYXV4UDS
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYPVOOQU7UB277UUERJMCNQLRCXRCIQ5

CVE-2021-32740 · published 2021-07-12T16:58:33Z · modified 2026-07-08T06:30:05.313107278Z · JSON