---
id: "CVE-2026-126348"
page: "https://infrastack.ai/live/CVE-2026-126348"
kind: "vulnerability"
aliases: ["CVE-2026-126348", "GHSA-9crm-g4mf-wc5j"]
title: "Addressable display_uri can show misleading hosts with invalid Punycode A-labels"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "addressable", "fixed": ["2.9.1"], "affected": ">= 2.0.0, < 2.9.1", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["addressable", "cwe-1007", "cwe-20", "package", "ruby", "rubygems"]
not_affected_if: ["native-idn", "normalized-host-only"]
published_at: "2026-11-12T22:19:19+00:00"
first_seen_at: "2026-11-12T22:40:37+00:00"
updated_at: "2026-11-12T22:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126348", "first_seen_at": "2026-11-12T22:40:37+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-9crm-g4mf-wc5j", "first_seen_at": "2026-11-12T22:47:10+00:00"}]
exploit_sources: []
---

# Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Link for people: https://infrastack.ai/live/CVE-2026-126348 (this .md is for agents)

The Ruby Addressable library decodes invalid Punycode host labels when building display text, so a URL can show a different hostname than the one it actually connects to. An attacker who controls a domain can make a link look like a trusted host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:addressable affected >= 2.0.0, < 2.9.1 fixed 2.9.1

## How to check

- Check the installed version with `bundle exec gem list addressable` or look for `addressable` in Gemfile.lock.
- Check whether the native IDNA is in use: `gem list idn-ruby` (if present with libidn, the pure-Ruby path is not used).
- Look for code that uses `display_uri` or `to_unicode` output for trust or host comparison.

## Fix

- Addressable: upgrade to `2.9.1`.

## Timeline

- 2026-11-12T22:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126348
- 2026-11-12T22:47:10+00:00 ghsa https://github.com/advisories/GHSA-9crm-g4mf-wc5j

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/sporkmonger/addressable/security-advisories/GHSA-9crm-g4mf-wc5j
- [fix] Patch: github.com https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d
- [fix] Release: github.com https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1

## From the sources

### Impact

`Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:

- labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`;
- labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form.

`Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same.

The native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected.

### Affected Versions

This vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.

### Workarounds

- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation.
- Don't make security decisions on `display_uri` or `to_unicode` output. Compare hosts using `normalized_host`.

### Credits

Reported by @tonghuaroot.

### For more information

If there are any questions or comments about this advisory:
* [Open an issue](https://github.com/sporkmonger/addressable/issues)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_