A vulnerability in the Addressable Ruby library allows unauthenticated attackers to trigger catastrophic backtracking, leading to severe resource exhaustion and denial of service.

The library suffers from inefficient regular expression complexity (CWE-1333) within its URI template implementation, specifically when using the explode modifier or multiple variables with certain operators. An unauthenticated attacker can supply a maliciously crafted URI to trigger unbounded backtracking and uncontrolled resource consumption.

This flaw poses a significant risk to the availability of any application relying on the Addressable library for URI parsing. A successful exploit can lead to a denial of service, rendering affected services unresponsive and causing operational downtime. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent malicious actors from disrupting business-critical workflows.

Immediate Action: Update the Addressable library to version 2.9.0 or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor server CPU utilization and error logs for spikes in processing time or thread exhaustion events that correlate with incoming URI requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter or block malformed URI requests that exhibit signs of complex template expansion, although this should be considered a temporary measure pending a full library update.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for a complete denial of service, organizations must prioritize patching the Addressable library. Administrators should verify their dependency trees to identify and upgrade all instances of this component immediately. Failure to address this vulnerability leaves systems exposed to trivial resource exhaustion attacks.