CVE-2026-126354

Not finished: this entry still needs a checked upper bound for every package. Do not commit it as it is.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>rubygem-addressable -- FIXME</topic>
    <affects>
      <package>
	<name>rubygem-addressable</name>
	<range><ge>2.2.5</ge><lt>2.9.1</lt></range>
      </package>
      <package>
	<name>rubygem-addressable28</name>
	<!-- no fixed release for the 2.8 line in the CVE record (fixed in 2.9.1) -->
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-126354: Addressable is an alternative implementation to the
	  URI implementation that is part of Ruby's standard library. From
	  2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a
	  path containing leading parent segments and later parent segments
	  to a different path than an RFC 3986 resolver. URI#normalize,
	  URI#join, URI#==, and URI#=== inherit the result. An application
	  that authorizes the Addressable-normalized path but sends the
	  original URI to another resolver can allow access outside the
	  intended path allowlist. Applications that use the same normalized
	  value for authorization and the request, or reject parent segments,
	  are unaffected. This issue is fixed in version 2.9.1.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-126354</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-126354</url>
    </references>
    <dates>
      <discovery>2026-11-12</discovery>
      <entry>2026-11-13</entry>
    </dates>
  </vuln>