URI Implementation Vulnerability in Addressable by Sporkmonger
CVE-2026-126348
4.3MEDIUM
What is CVE-2026-126348?
The Addressable library's pure-Ruby IDNA.to_unicode method fails to handle invalid Punycode A-labels correctly from versions 2.0.0 to 2.9.1. This flaw can lead to scenarios where an attacker subtly manipulates hostnames, causing the Addressable::URI#display_uri method to present a deceivingly trusted host while maintaining attacker-controlled hosts underneath. This undermines the integrity of trusted-name comparisons, incorrectly equating distinct hosts. The underlying native libidn implementation is unaffected, and users should update to version 2.9.1 to mitigate this risk.
Affected Version(s)
addressable >= 2.0.0, < 2.9.1