- Severity: MEDIUM
- CVE: CVE-2026-126348
- Ecosystems: rubygems
- Packages: addressable
### Impact
`Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:
– labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`;
– labels that decode to text that doesn’t convert back to the same label (RFC 3490 §4.2), e.g. text that isn’t in normalized form.
`Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don’t control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same.
The native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected.
### Affected Versions
This vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.
### Workarounds
– Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation.
– Don’t make security de…
Source: GitHub Security Advisories · 2026-11-12