{"id":"CVE-2026-126349","summary":"Addressable display_uri can show misleading hosts containing bidi and invisible characters","details":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.","aliases":["GHSA-539f-xcgw-2gjg"],"modified":"2026-11-13T10:46:42.886852618Z","published":"2026-11-12T22:00:22.516Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126349.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1007","CWE-176","CWE-451"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126349.json"},{"type":"FIX","url":"https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"type":"ADVISORY","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126349"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sporkmonger/addressable","events":[{"introduced":"126259d1ef0315fa0b1cad07b8194748763e2bf2"},{"fixed":"afa66636d9fdcca11e03c85cf166651e0efa68ef"},{"fixed":"60455d32bb59fda2585a0e1865a9fcb21e8e55b1"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"60455d32bb59fda2585a0e1865a9fcb21e8e55b1"}]},{"range":[{"fixed":"afa66636d9fdcca11e03c85cf166651e0efa68ef"}],"source":"REFERENCES_TAG","original_tag":"addressable-2.9.1"}]}}],"versions":["addressable-2.9.0","addressable-2.8.10","addressable-2.8.9","addressable-2.8.8","addressable-2.8.7","addressable-2.8.6","addressable-2.8.5","addressable-2.8.4","addressable-2.8.3","addressable-2.8.2","addressable-2.8.1","addressable-2.7.0","addressable-2.6.0","addressable-2.5.2","addressable-2.5.1","addressable-2.5.0","addressable-2.4.0","addressable-2.3.8","addressable-2.3.7","addressable-2.3.6","addressable-2.3.5","addressable-2.3.4","addressable-2.3.3","addressable-2.3.2","addressable-2.3.1","addressable-2.3.0","addressable-2.2.8","addressable-2.2.7","addressable-2.2.6","addressable-2.2.5","addressable-2.2.4","addressable-2.2.3","addressable-2.2.2","addressable-2.2.1","addressable-2.2.0","addressable-2.1.2","addressable-2.1.1","addressable-2.1.0","addressable-2.0.2","addressable-2.0.1","addressable-2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126349.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}