{"id":"CVE-2026-126348","summary":"Addressable display_uri can show misleading hosts with invalid Punycode A-labels","details":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1.","aliases":["GHSA-9crm-g4mf-wc5j"],"modified":"2026-11-13T10:46:43.803640319Z","published":"2026-11-12T21:57:55.237Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1007","CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126348.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126348.json"},{"type":"FIX","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"type":"ADVISORY","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126348"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sporkmonger/addressable","events":[{"introduced":"126259d1ef0315fa0b1cad07b8194748763e2bf2"},{"fixed":"afa66636d9fdcca11e03c85cf166651e0efa68ef"},{"fixed":"b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"}]},{"range":[{"fixed":"afa66636d9fdcca11e03c85cf166651e0efa68ef"}],"source":"REFERENCES_TAG","original_tag":"addressable-2.9.1"}]}}],"versions":["addressable-2.9.0","addressable-2.8.10","addressable-2.8.9","addressable-2.8.8","addressable-2.8.7","addressable-2.8.6","addressable-2.8.5","addressable-2.8.4","addressable-2.8.3","addressable-2.8.2","addressable-2.8.1","addressable-2.7.0","addressable-2.6.0","addressable-2.5.2","addressable-2.5.1","addressable-2.5.0","addressable-2.4.0","addressable-2.3.8","addressable-2.3.7","addressable-2.3.6","addressable-2.3.5","addressable-2.3.4","addressable-2.3.3","addressable-2.3.2","addressable-2.3.1","addressable-2.3.0","addressable-2.2.8","addressable-2.2.7","addressable-2.2.6","addressable-2.2.5","addressable-2.2.4","addressable-2.2.3","addressable-2.2.2","addressable-2.2.1","addressable-2.2.0","addressable-2.1.2","addressable-2.1.1","addressable-2.1.0","addressable-2.0.2","addressable-2.0.1","addressable-2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126348.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}