CVE-2026-126349

### Impact `Addressable::IDNA.to_unicode` decodes Punycode labels (labels beginning with `xn--`) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. `Addressable::URI#display_uri` uses `to_unicode`, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of `http://xn--abcmoc-dm0c.com/` is displayed as `abc`, U+202E, `moc.com`, and the override makes everything after `abc` render right to left. Parsing, `host`, `normalized_host` and any connection made from the URI are not affected. Only the displayed form is. Applications that show `display_uri` to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one. - In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits. - In the native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069. ### Affected Versions The pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when `to_unicode` began accepting characters unassigned in Unicode 3.2. It is fixed in 2.9.1 for both implementations, where such labels are returned unchanged. ### Workarounds - Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation. This reduces the affected characters to those added since Unicode 3.2. - Check displayed hosts for bidirectional and invisible characters (e.g., `/[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/`) and fall back to `normalized_host` when one is present. ### Credits