GHSA-H97M-WW89-6JMQ `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

🗓️ 09 Dec 2024 20:41:10Reported by GoogleType

osv

osv🔗 osv.dev👁 13 Views

Upgrade `idna` to fix privilege escalation from unprocessed Punycode label comparisons.

Reporter	Title	Published	Views	Family All 165
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to naming confusion (CVE-2024-12224)	2 Apr 202520:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	4 May 202607:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to idna-0.1.5.crate, idna-0.5.0.crate CVE-2024-12224	8 May 202515:19	–	ibm
AlpineLinux	CVE-2024-12224	30 May 202501:16	–	alpinelinux
BDU FSTEC	The vulnerability of the Punycode character transformation method, which is used to process domain names, allows attackers to increase their privileges.	28 Oct 202500:00	–	bdu_fstec
Chainguard	CVE-2024-12224 vulnerabilities	9 Dec 202412:00	–	cgr
Circl	CVE-2024-12224	30 May 202502:41	–	circl
CNNVD	Servo 安全漏洞	30 May 202500:00	–	cnnvd
CVE	CVE-2024-12224	30 May 202501:16	–	cve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-12224
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
github	www.github.com/servo/rust-url
rustsec	www.rustsec.org/advisories/RUSTSEC-2024-0421.html

04 Feb 2026 04:28Current

4.9Medium risk

Vulners AI Score4.9

CVSS 46.3

EPSS0.00194

punycode label issue privilege escalation risk upgrade `idna`dns entry vulnerability utf-8 specification fix.