sporkmonger Addressable up to 2.9.0 IDNA IDNA.to_unicode input validation

Summaryinfo

A vulnerability was found in sporkmonger Addressable up to 2.9.0. It has been declared as problematic. This affects the function Addressable::IDNA.to_unicode of the component IDNA. The manipulation results in input validation. This vulnerability is cataloged as CVE-2026-126348. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in sporkmonger Addressable up to 2.9.0. Affected is the function Addressable::IDNA.to_unicode of the component IDNA. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. CVE summarizes:

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-126348 since 11/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 2.9.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• sporkmonger

Name

• Addressable

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9.0

Website

• Product: https://github.com/sporkmonger/addressable/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion