CVE-2026-126348 Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

CVE-2026-126348

The Addressable library (versions 2.0.0 to 2.9.1 ) contains a vulnerability in its pure-Ruby Addressable::IDNA.to_unicode implementation. The flaw allows the library to decode invalid Punycode A-labels instead of returning them unchanged. This can result in Addressable::URI#display_uri showing a ...