CVE-2024-12224 idna accepts Punycode labels that do not produce any non-ASCII when decoded

🗓️ 30 May 2025 01:16:47Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Improper validation in punycode may lead to hostname equivalence issues in the idna crate.

Reporter	Title	Published	Views	Family All 179
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to naming confusion (CVE-2024-12224)	2 Apr 202520:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	4 May 202607:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to idna-0.1.5.crate, idna-0.5.0.crate CVE-2024-12224	8 May 202515:19	–	ibm
AlpineLinux	CVE-2024-12224	30 May 202501:16	–	alpinelinux
BDU FSTEC	The vulnerability of the Punycode character transformation method, which is used to process domain names, allows attackers to increase their privileges.	28 Oct 202500:00	–	bdu_fstec
Chainguard	CVE-2024-12224 vulnerabilities	9 Dec 202412:00	–	cgr
Circl	CVE-2024-12224	30 May 202502:41	–	circl
CNNVD	Servo 安全漏洞	30 May 202500:00	–	cnnvd
CVE	CVE-2024-12224	30 May 202501:16	–	cve

Source	Link
crates	www.crates.io/crates/idna
github	www.github.com/servo/rust-url/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12224.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-12224
rustsec	www.rustsec.org/advisories/RUSTSEC-2024-0421.html
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi

16 Jul 2026 10:14Current

7.2High risk

Vulners AI Score7.2

CVSS 45.1

EPSS0.00201

cve-2024-12224 punycode vulnerability idna crate hostname equivalence security flaw