Description
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.
Published: 2026-11-12
Score: 3.1 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-539f-xcgw-2gjg Addressable display_uri can show misleading hosts containing bidi and invisible characters
History

Thu, 12 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
Description Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.
Title Addressable display_uri can show misleading hosts containing bidi and invisible characters
Weaknesses CWE-1007
CWE-176
CWE-451
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-12T22:00:22.516Z

Reserved: 2026-11-10T21:12:01.227Z

Link: CVE-2026-126349

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-12T22:19:20.080

Modified: 2026-11-12T22:19:20.080

Link: CVE-2026-126349

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1007

    Insufficient Visual Distinction of Homoglyphs Presented to User

  • CWE-176

    Improper Handling of Unicode Encoding

  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information