CVE-2026-126349

Name of the Vulnerable Software and Affected Versions Addressable versions 2.0.0 through 2.9.0

Description Addressable::IDNA.to unicode decodes Punycode labels containing bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Consequently, Addressable::URI#display uri can show a hostname that is visually indistinguishable from another or appears reordered, even though the actual network connections and normalized host use the original encoded hostname. This can be used in applications that show link previews or admin interfaces to make a malicious domain appear trusted. In the pure-Ruby backend, all prohibited characters are decoded. In the native libidn backend, characters added after Unicode 3.2 are affected.

Recommendations Update Addressable to version 2.9.1. As a temporary workaround, install libidn and the idn-ruby gem to use the native IDNA implementation, which limits the affected characters. As a temporary workaround, check displayed hosts for bidirectional and invisible characters and fall back to normalized host if any are found.