ADDRESSABLE · CVE-2026-126348 · Package
FIX → 2.9.1
Addressable's pure-Ruby IDNA decoder turns invalid Punycode labels into readable text, so display_uri can show a trusted-looking host while the real connection target is different. A trusted-name comparison using to_unicode output can also treat two different hosts as identical.
first public Oct 30, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the Addressable gem from 2.0.0 through 2.9.1 to show or compare URI hosts that may contain attacker-supplied Punycode. Code that only uses the native libidn path, to_ascii, or normalized_host is not affected, and code that never displays or trust-compares decoded hosts has little exposure.
Not affected if native-libidn, no-display-uri, no-unicode-host-compare
Who cares addressable, ruby
grep -i addressable Gemfile.lockdisplay_uri output or compares hosts via Addressable::IDNA.to_unicode to decide trustUpgrade to 2.9.1
2.9.1 or laterAddressable::IDNA.to_unicode, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with xn--) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:
xn--google- decodes to google;Addressable::URI#display_uri uses to_unicode, so for https://xn--google-.example.org/ it displays the host google.example.org, while #host, #normalized_host and any connection made from the URI use xn--google-.example.org. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of against a list of trusted names can likewise treat two different hosts as the same.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
to_unicodeThe native IDNA implementation, used when libidn and the idn-ruby gem are installed, is not affected. to_ascii and normalized_host are not affected.
This vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.
idn-ruby gem, so that Addressable uses the native IDNA implementation.display_uri or to_unicode output. Compare hosts using normalized_host.Reported by @tonghuaroot.
If there are any questions or comments about this advisory:
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.