CVE-2026-126348
Addressable display_uri can show misleading hosts with invalid Punycode A-labels
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1.
| CWE | CWE-20 CWE-1007 |
| Vendor | sporkmonger |
| Product | addressable |
| Published | Nov 12, 2026 |
| Last Updated | Nov 13, 2026 |
Get instant alerts for sporkmonger addressable
Be the first to know when new medium vulnerabilities affecting sporkmonger addressable are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N