GHSA-539F-XCGW-2GJG Addressable display_uri can show misleading hosts containing bidi and invisible characters

Impact Addressable::IDNA.tounicode decodes Punycode labels labels beginning with xn-- that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, a...

CVE-2026-126349

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.tounicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable...

CVE-2026-126348

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

EUVD-2026-124729

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.tounicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable...

EUVD-2026-124728

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

CVE-2026-126348 Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

CVE-2026-126348

The Addressable library (versions 2.0.0 to 2.9.1 ) contains a vulnerability in its pure-Ruby Addressable::IDNA.to_unicode implementation. The flaw allows the library to decode invalid Punycode A-labels instead of returning them unchanged. This can result in Addressable::URI#display_uri showing a ...

CVE-2026-126348: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

PT-2026-146069

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorabl...

CVE-2026-126349: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.tounicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable...