Skip to content

Commit c396493

Browse files
flavorjonesRubySec CI
flavorjones
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@55bb269 
1 parent 2405c77 commit c396493

2 files changed

Lines changed: 196 additions & 0 deletions

File tree

‎advisories/_posts/2026-04-08-CVE-2026-35611.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-35611 (addressable): Addressable has a Regular Expression Denial
4+
of Service in Addressable templates'
5+
comments: false
6+
categories:
7+
- addressable
8+
advisory:
9+
gem: addressable
10+
cve: 2026-35611
11+
ghsa: h27x-rffw-24p4
12+
url: https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4
13+
title: Addressable has a Regular Expression Denial of Service in Addressable templates
14+
date: 2026-04-08
15+
description: |-
16+
### Impact
17+
18+
Within the URI template implementation in Addressable, two classes
19+
of URI template generate regular expressions vulnerable to
20+
catastrophic backtracking:
21+
22+
1. Templates using the `*` (explode) modifier with any expansion
23+
operator (e.g., `{foo*}`, `{+var*}`, `{#var*}`, `{/var*}`,
24+
`{.var*}`, `{;var*}`, `{?var*}`, `{&var*}`) generate patterns
25+
with nested unbounded quantifiers that are O(2^n) when matched
26+
against a maliciously crafted URI.
27+
28+
2. Templates using multiple variables with the `+` or `#` operators
29+
(e.g., `{+v1,v2,v3}`) generate patterns with O(n^k) complexity
30+
due to the comma separator being within the matched character
31+
class, causing ambiguous backtracking across k variables.
32+
33+
When matched against a maliciously crafted URI, this can result
34+
in catastrophic backtracking and uncontrolled resource consumption,
35+
leading to denial of service. The first pattern was partially
36+
addressed in 2.8.10 for certain operator combinations. Both patterns
37+
are fully remediated in 2.9.0.
38+
39+
Users of the URI parsing capabilities in Addressable but not
40+
the URI template matching capabilities are unaffected.
41+
42+
### Affected Versions
43+
44+
This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and
45+
2.3.1 were yanked; the earliest installable release is 2.3.2).
46+
It was partially fixed in version 2.8.10 and fully remediated in 2.9.0.
47+
48+
The vulnerability is more exploitable on MRI Ruby < 3.2 and on all
49+
versions of JRuby and TruffleRuby. MRI Ruby 3.2 and later ship with
50+
Onigmo 6.9, which introduces memoization that prevents catastrophic
51+
backtracking for the first class of template. JRuby and TruffleRuby
52+
do not implement equivalent memoization and remain vulnerable
53+
to all patterns.
54+
55+
This has been confirmed on the following runtimes:
56+
57+
| Runtime | Status |
58+
|--------------|--------|
59+
| MRI Ruby 2.6 | Vulnerable |
60+
| MRI Ruby 2.7 | Vulnerable |
61+
| MRI Ruby 3.0 | Vulnerable |
62+
| MRI Ruby 3.1 | Vulnerable |
63+
| MRI Ruby 3.2 | Partially vulnerable |
64+
| MRI Ruby 3.3 | Partially vulnerable |
65+
| MRI Ruby 3.4 | Partially vulnerable |
66+
| MRI Ruby 4.0 | Partially vulnerable |
67+
| JRuby 10.0 | Vulnerable |
68+
| TruffleRuby 21.2 | Vulnerable |
69+
70+
### Workarounds
71+
72+
- **Upgrade to MRI Ruby 3.2 or later**, if your application does
73+
not use JRuby or TruffleRuby. The Onigmo memoization introduced
74+
in MRI Ruby 3.2 prevents catastrophic backtracking from nested
75+
unbounded quantifiers (pattern 1 above — templates using the `*`
76+
modifier). It does not reliably mitigate the O(n^k) multi-variable
77+
case (pattern 2), so upgrading Ruby alone may not be sufficient
78+
if your templates use `{+v1,v2,...}` or `{#v1,v2,...}` syntax.
79+
80+
- **Avoid using vulnerable template patterns** when matching
81+
user-supplied input on unpatched versions of the library:
82+
83+
- Templates using the `*` (explode) modifier: `{foo*}`, `{+var*}`,
84+
`{#var*}`, `{.var*}`, `{/var*}`, `{;var*}`, `{?var*}`, `{&var*}`
85+
86+
- Templates using multiple variables with the `+` or `#`
87+
operators: `{+v1,v2}`, `{#v1,v2,v3}`, etc.
88+
89+
- **Apply a short timeout** around any call to `Template#match`
90+
or `Template#extract` that processes user-supplied data.
91+
92+
### Credits
93+
94+
Discovered in collaboration with @jamfish.
95+
96+
### For more information
97+
98+
If you have any questions or comments about this advisory:
99+
* [Open an issue](https://github.com/sporkmonger/addressable/issues)
100+
cvss_v3: 7.5
101+
unaffected_versions:
102+
- "< 2.3.0"
103+
patched_versions:
104+
- ">= 2.9.0"
105+
related:
106+
url:
107+
- https://nvd.nist.gov/vuln/detail/CVE-2026-35611
108+
- https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4
109+
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
110+
- https://cwe.mitre.org/data/definitions/1333.html
111+
- https://www.regular-expressions.info/catastrophic.html
112+
- https://github.com/advisories/GHSA-h27x-rffw-24p4
113+
---

‎advisories/_posts/2026-04-08-CVE-2026-39324.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-39324 (rack-session): Rack::Session::Cookie secrets: decrypt failure
4+
fallback enables secretless session forgery and Marshal deserialization'
5+
comments: false
6+
categories:
7+
- rack-session
8+
advisory:
9+
gem: rack-session
10+
cve: 2026-39324
11+
ghsa: 33qg-7wpp-89cq
12+
url: https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq
13+
title: 'Rack::Session::Cookie secrets: decrypt failure fallback enables secretless
14+
session forgery and Marshal deserialization'
15+
date: 2026-04-08
16+
description: |-
17+
'Rack::Session::Cookie incorrectly handles decryption failures when
18+
configured with `secrets:`. If cookie decryption fails, the
19+
implementation falls back to a default decoder instead of rejecting
20+
the cookie. This allows an unauthenticated attacker to supply a
21+
crafted session cookie that is accepted as valid session data
22+
without knowledge of any configured secret.
23+
24+
Because this mechanism is used to load session state, an attacker
25+
can manipulate session contents and potentially gain unauthorized access.
26+
27+
## Details
28+
29+
When `secrets:` is configured, `Rack::Session::Cookie` attempts to
30+
decrypt incoming session cookies using one of the configured encryptors.
31+
If all decrypt attempts fail, the implementation does not reject
32+
the cookie. Instead, it falls back to decoding the cookie using
33+
a default coder.
34+
35+
This fallback path processes attacker-controlled cookie data as
36+
trusted session state. The behavior is implicit and occurs even
37+
when encrypted cookies are expected.
38+
39+
The fallback decoder is applied automatically and does not require
40+
the application to opt into a non-encrypted session format. As a
41+
result, a client can send a specially crafted cookie value that
42+
bypasses the intended integrity protections provided by `secrets:`.
43+
44+
This issue affects both default configurations and those using
45+
alternative serializers for encrypted payloads.
46+
47+
## Impact
48+
49+
Any Rack application using `Rack::Session::Cookie` with
50+
`secrets:` may be affected.
51+
52+
> [!NOTE]
53+
> Rails applications are typically not affected — Rails uses
54+
> `ActionDispatch::Session::CookieStore`, which is a separate
55+
> implementation backed by `ActiveSupport::MessageEncryptor`
56+
> and does not share the vulnerable code path.
57+
58+
An unauthenticated attacker can supply a crafted session cookie
59+
that is accepted as valid session data. This can lead to authentication
60+
bypass or privilege escalation in applications that rely on session
61+
values for identity or authorization decisions.
62+
63+
Depending on application behavior and available runtime components,
64+
processing of untrusted session data may also expose additional risks.
65+
66+
## Mitigation
67+
68+
* Update to a patched version of `rack-session` that rejects cookies
69+
when decryption fails under the `secrets:` configuration.
70+
* After updating, rotate session secrets to invalidate existing
71+
session cookies, since attacker-supplied session data may have
72+
been accepted and re-issued prior to the fix.'
73+
cvss_v4: 9.3
74+
unaffected_versions:
75+
- "< 2.0.0"
76+
patched_versions:
77+
- ">= 2.1.2"
78+
related:
79+
url:
80+
- https://nvd.nist.gov/vuln/detail/CVE-2026-39324
81+
- https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq
82+
- https://github.com/advisories/GHSA-33qg-7wpp-89cq
83+
---

0 commit comments

Comments
 (0)