{"action":"Upgrade addressable to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"2.3.0"}],"component":"addressable","cve_ids":["CVE-2026-35611"],"ecosystem":"RubyGems","epss":0.0036,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-h27x-rffw-24p4","id":"tcs_01M5KEKFBZH18X3G94B83PMW1C","modified_at":"2026-09-10T03:51:01.804376746Z","published_at":"2026-04-08T00:05:27Z","references":["https://osv.dev/vulnerability/GHSA-h27x-rffw-24p4","https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4","https://nvd.nist.gov/vuln/detail/CVE-2026-35611","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/CVE-2026-35611.yml","https://github.com/sporkmonger/addressable"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h27x-rffw-24p4","url":"https://osv.dev/vulnerability/GHSA-h27x-rffw-24p4"}],"summary":"Addressable has a Regular Expression Denial of Service in Addressable templates"}