CVE-2026-126348

### Impact `Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes: - labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`; - labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form. `Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same. The native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected. ### Affected Versions This vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn. ### Workarounds - Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation. - Don't make security decisions on `display_uri` or `to_unicode` output. Compare hosts using `normalized_host`. ### Credits Reported by @tonghuaroot. ### For more information If there are any questions or comments about this advisory: * [Open an issue](https://github.com/sporkmonger/addressable/issues)