CVE-2026-126349

Received Received - Intake

Addressable IDNA Punycode Homograph Attack Vulnerability

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126349

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1007	The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
CWE-176	The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Addressable gem in Ruby, specifically versions 2.0.0 to 2.9.1. It allows Punycode labels in hostnames to be decoded in a way that includes hidden or reordered characters like bidirectional controls or zero-width characters. This can make a malicious hostname appear normal or visually similar to a legitimate one in the display_uri method, even though the actual host or network connection uses the original encoded hostname.

Impact Analysis

This vulnerability could trick users into visiting malicious websites that appear legitimate due to reordered or visually altered hostnames. It may lead to phishing attacks, unauthorized access, or data breaches if users interact with spoofed domains. Systems using vulnerable versions of Addressable are at risk of being misled by these deceptive hostnames.

Mitigation Strategies

Update the Addressable gem to version 2.9.1 or later to address the vulnerability in Addressable::IDNA.to_unicode and Addressable::URI#display_uri.

Hi! I’m here to help you understand CVE-2026-126349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...