Threats tagged 'brew-krane-cve-2026-126349'

Addressable library versions >= 2.0.0 (pure-Ruby IDNA) and >= 2.5.2 (native IDNA) have a vulnerability where the display_uri method can show misleading hostnames containing bidirectional and invisible Unicode characters. This can cause malicious domains to appear visually similar to trusted ones in user interfaces that display these URIs. The issue affects only the displayed form, not the actual host parsing or connections. It is fixed in version 2.9.1 where such labels are returned unchanged.