- Severity: LOW
- CVE: CVE-2026-126349
- Ecosystems: rubygems
- Packages: addressable
### Impact
`Addressable::IDNA.to_unicode` decodes Punycode labels (labels beginning with `xn--`) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. `Addressable::URI#display_uri` uses `to_unicode`, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of `http://xn--abcmoc-dm0c.com/` is displayed as `abc`, U+202E, `moc.com`, and the override makes everything after `abc` render right to left.
Parsing, `host`, `normalized_host` and any connection made from the URI are not affected. Only the displayed form is. Applications that show `display_uri` to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.
– In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA’s nameprep profile prohibits.
– In the native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.
### Affected Versions
The pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when `to_unicode` began accepting character…
Source: GitHub Security Advisories · 2026-11-12