{"id":"CVE-2026-126348","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-126348","summary":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation…","details":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1.","published":"2026-11-12T22:19:19.930","modified":"2026-11-12T22:19:19.930","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d","label":"sporkmonger/addressable@b8a59cc"},"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-12T22:19:19.930"}}