Skip to content
Fencer Vulns
high 7.5

CVE-2021-32740 json

Regular Expression Denial of Service in Addressable templates

published 2021-07-06 5 y ago modified 2026-07-08 4 mo ago also GHSA-jxhc-q857-3j6g , EUVD-2021-1480

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

Patch / fix

  • rubygems addressable 2.8.0
  • addressable_project addressable 2.8.0
  • ruby-addressable Debian 14, Debian 13, Debian 12 2.7.0-2

debian advisories DEBIAN-CVE-2021-32740

  • foreman satellite capsule 6.10, satellite 6.10 2.5.2.17-2.el7sat
  • candlepin satellite 6.10 4.0.9-1.el7sat
  • satellite satellite capsule 6.10, satellite 6.10 6.10.0-3.el7sat
  • python-ecdsa satellite capsule 6.10, satellite 6.10 0.13.3-2.el7pc
  • python-pyyaml satellite capsule 6.10, satellite 6.10 5.4.1-1.el7pc
  • python3-ecdsa satellite capsule 6.10, satellite 6.10 0.13.3-2.el7pc
  • python-aiohttp satellite capsule 6.10, satellite 6.10 3.7.4-1.el7pc
  • python-urllib3 satellite capsule 6.10, satellite 6.10 1.26.5-1.el7pc

red hat advisories RHSA-2021:4702

  • rubygem-addressable OpenStack Cloud Crowbar 8 2.3.6-3.3.3
  • rubygem-addressable OpenStack Cloud Crowbar 9 2.3.6-4.3.3

suse advisories SUSE-SU-2021:2928-1SUSE-SU-2021:2927-1

  • rubygem-http openSUSE Tumbleweed 5.1.0-1.1
  • ruby3.2-rubygem-http openSUSE Tumbleweed 5.1.0-1.4

opensuse advisories openSUSE-SU-2024:12247-1openSUSE-SU-2024:13157-1

  • ruby-addressable Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 2.8.0-r0

alpine advisories ALPINE-CVE-2021-32740

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ruby-addressable Arch Linux 2.8.0-1

arch linux advisories AVG-2136

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32740 updated cvss 7.5

rubygem-addressable: ReDoS in templates

  • Red Hat CloudForms Management Engine 5 cfme-gemset
    affected: workaround, no fix planned “Create template objects only from trusted sources that have been validated not to produce catastrophic backtracking.”
  • Red Hat 3scale API Management Platform 2 system, 3scale-toolbox 3scale-toolbox, 3scale-amp-system 3scale-amp-system
    affected: workaround, no fix available, no fix planned “Create template objects only from trusted sources that have been validated not to produce catastrophic backtracking.”
  • Red Hat OpenShift Container Platform 3.11 logging-fluentd Red Hat OpenShift Container Platform 4 openshift4/ose-logging-fluentd Red Hat OpenStack Platform 13 (Queens) Operational Tools rubygem-addressable Red Hat Single Sign-On 7 rcue-addressable rcue-addressable
    affected: workaround, no fix planned “Create template objects only from trusted sources that have been validated not to produce catastrophic backtracking.”
  • Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v5.2.0-10
    fixed: vendor fix “Create template objects only from trusted sources that have been validated not to produce catastrophic backtracking.” RHBA-2021:3393
  • Red Hat Satellite 6.10 tfm-rubygem-addressable 2.8.0-1.el7sat
    fixed: vendor fix “Create template objects only from trusted sources that have been validated not to produce catastrophic backtracking.” RHSA-2021:4702
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/eventrouter-rhel9 Red Hat OpenShift Logging 5.2 openshift-logging/kibana6-rhel8 v5.2.0-9, openshift-logging/eventrouter-rhel8 v5.2.0-10, openshift-logging/elasticsearch6-rhel8 v5.2.0-8, openshift-logging/logging-curator5-rhel8 v5.2.0-8, openshift-logging/elasticsearch-proxy-rhel8 v5.2.0-11, openshift-logging/elasticsearch-rhel8-operator v5.2.0-14, +4 more Red Hat Satellite 6.10 tfm 7.0-1.el7sat, gofer 2.12.5-7.el7sat, katello 4.1.1-2.el7sat, libsolv 0.7.20-1.el7pc, receptor 0.6.4-2.el7ar, libcomps 0.1.15-1.el7pc, +581 more Red Hat Satellite Capsule 6.10 tfm 7.0-1.el7sat, katello 4.1.1-2.el7sat, libsolv 0.7.20-1.el7pc, libcomps 0.1.15-1.el7pc, python-rq 1.8.1-1.el7pc, python-idna 2.10-1.el7pc, +355 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.14% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
rubygems addressable
>=2.3.0, <2.8.0
2.8.0

Affected products

  • sporkmonger addressable

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.