CVE-2026-126349

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.

• CWE-176
• CWE-451
• CWE-1007

• https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1
• https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1
• https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126343@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126344@hono/node-server allows running the Hono application on Nod…5.4
• CVE-2026-126345basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the …5.3
• CVE-2026-126346basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPC…5.9
• CVE-2026-126347Tornado is a Python web framework and asynchronous networkin…3.1
• CVE-2026-126348Addressable is an alternative implementation to the URI impl…4.3
• CVE-2026-12635GitLab has remediated an issue in GitLab CE/EE affecting all…3.1
• CVE-2026-126350Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126351Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126352Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126353Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126354Addressable is an alternative implementation to the URI impl…4.8