CVE-2021-32740: Addressable URI Template DoS Vulnerability

CVE-2021-32740 Overview

CVE-2021-32740 is a denial of service vulnerability affecting Addressable, an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI.

In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable had cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected.

Critical Impact

Malicious URI templates can cause catastrophic backtracking, consuming excessive CPU and memory resources, leading to application-level denial of service conditions.

Affected Products

• Addressable versions after 2.3.0 through 2.7.0 (Ruby gem)
• Fedora 33
• Fedora 34

Discovery Timeline

• 2021-07-06 - CVE-2021-32740 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32740

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw exists within Addressable's URI template matching functionality, where certain maliciously constructed templates can trigger catastrophic backtracking behavior during regex evaluation. This algorithmic complexity attack exploits the way the template matching engine processes complex patterns against input URIs.

When a vulnerable template is matched against a URI, the regex engine may enter an exponential time complexity state, causing the application to consume excessive CPU cycles and potentially memory. This can lead to a complete denial of service for the affected Ruby application, impacting availability for all users relying on that service.

The vulnerability is network-exploitable, requiring no privileges or user interaction to trigger. An attacker who can influence the URI templates processed by an application using Addressable can cause resource exhaustion by submitting carefully crafted malicious templates.

Root Cause

The root cause lies in the regular expression implementation within Addressable's URI template matching system. When processing certain template patterns, the regex engine exhibits catastrophic backtracking behavior—a known algorithmic complexity issue where the regex evaluator explores an exponential number of possible matches before determining a result.

This occurs because the template parsing logic did not include safeguards against pathological input patterns that could trigger worst-case regex performance. The template syntax allows for complex expressions that, when combined with specific URI inputs, cause the matching algorithm to recurse excessively.

Attack Vector

The attack can be executed remotely over the network. An attacker needs to supply a maliciously crafted URI template to an application that uses Addressable's template matching functionality. The attack requires no authentication and no user interaction.

The vulnerability manifests in the Template object's matching operations. When an application creates a Template object from untrusted input and attempts to match it against a URI, the malicious template triggers excessive resource consumption. For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2021-32740

Indicators of Compromise

• Abnormally high CPU utilization in Ruby processes running Addressable-dependent applications
• Application threads or workers becoming unresponsive during URI template operations
• Memory consumption spikes correlated with URI template matching requests
• Request timeouts or slow responses from services that process URI templates

Detection Strategies

• Monitor Ruby application logs for unusually long processing times in URI template operations
• Implement request timeout monitoring to detect hanging template matching operations
• Profile CPU usage patterns to identify regex-related resource exhaustion
• Audit application code for Template object creation from user-controlled input

Monitoring Recommendations

• Set up alerts for CPU utilization thresholds on servers running affected Ruby applications
• Implement request-level timeout monitoring for endpoints that process URI templates
• Monitor application response times and establish baselines for normal operation
• Track memory consumption patterns in Ruby worker processes

How to Mitigate CVE-2021-32740

Immediate Actions Required

• Upgrade Addressable gem to version 2.8.0 or later immediately
• Audit application code to identify all locations where Template objects are created
• Implement input validation for any user-controlled data used in URI templates
• Consider adding request timeouts to protect against resource exhaustion

Patch Information

The vulnerability is patched in Addressable version 2.8.0. The fix addresses the catastrophic backtracking issue in the URI template implementation. The patch is available via the GitHub commit.

To upgrade, update your Gemfile:

gem 'addressable', '>= 2.8.0'

Then run bundle update addressable to apply the update.

Fedora users should apply the relevant security updates as announced in the Fedora Package Announcements.

Workarounds

• Only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking
• Implement strict input validation to reject complex or suspicious template patterns before processing
• Add timeout wrappers around URI template matching operations to limit execution time
• If possible, avoid using URI template matching with any user-controlled input

# Check current Addressable version in your project
bundle show addressable

# Update to patched version
bundle update addressable

# Verify the update was applied
bundle show addressable
# Should show >= 2.8.0