1 line
3.5 KiB
JSON
1 line
3.5 KiB
JSON
{"schema_version":"1.9.2","id":"GHSA-9crm-g4mf-wc5j","published":"2026-11-12T22:44:57Z","modified":"2026-11-12T23:00:05.713087803Z","aliases":["CVE-2026-126348"],"summary":"Addressable display_uri can show misleading hosts with invalid Punycode A-labels","details":"### Impact\n\n`Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:\n\n- labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`;\n- labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form.\n\n`Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same.\n\nThe native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.\n\n### Workarounds\n\n- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation.\n- Don't make security decisions on `display_uri` or `to_unicode` output. Compare hosts using `normalized_host`.\n\n### Credits\n\nReported by @tonghuaroot.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-9crm-g4mf-wc5j.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1007","CWE-20"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:44:57Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]} |