CVE-2026-126348

Name of the Vulnerable Software and Affected Versions Addressable versions 2.0.0 through 2.9.0

Description In the pure-Ruby IDNA implementation, the Addressable::IDNA.to unicode function decodes invalid Punycode A-labels (labels starting with xn--) instead of returning them unchanged. This occurs when labels decode only to ASCII characters or fail to convert back to the original A-label. Consequently, Addressable::URI#display uri may show a trusted-looking host while the host, normalized host, and the actual connection target remain the attacker-controlled encoded host. Additionally, security comparisons using the output of Addressable::IDNA.to unicode may incorrectly treat two different hosts as identical.

Recommendations Update to version 2.9.1. Install libidn and the idn-ruby gem to enable the native IDNA implementation. Avoid making security decisions based on the output of display uri or to unicode, and instead compare hosts using normalized host.