URI Implementation Vulnerability in Addressable by Sporkmonger

CVE-2026-126349

What is CVE-2026-126349?

The Addressable library, an alternative to Ruby's standard URI implementation, contains a vulnerability affecting versions from 2.0.0 to 2.9.1. The issue arises when using the Addressable::IDNA.to_unicode method, which can decode Punycode labels containing bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. As a result, the Addressable::URI#display_uri method may present a reordered or visually indistinguishable hostname. While the original encoded hostname is used for connections, this flaw can mislead users or systems relying on visual representation. This weakness persists in the pure-Ruby backend, while the native libidn backend is affected starting from version 2.5.2 due to characters added after Unicode 3.2. The vulnerability has been addressed in version 2.9.1.

References