CVE-2026-126349

The Addressable library (versions 2.0.0 through 2.9.1 ) is vulnerable because Addressable::IDNA.to_unicode can decode Punycode labels containing bidirectional controls, zero-width characters, and other default-ignorable format characters. This allows Addressable::URI#display_uri to present a reor...