Threats tagged 'brew-travis-cve-2026-126348'

A vulnerability in the pure-Ruby IDNA implementation of the Addressable library allows certain invalid Punycode A-labels to be decoded incorrectly by the to_unicode method. This causes the display_uri method to show misleading hostnames that differ from the actual host used in connections. This can lead to confusion or incorrect trust decisions if applications rely on display_uri or to_unicode output for security checks. The issue affects Addressable versions from 2.0.0 up to but not including 2.9.1 and is fixed in version 2.9.1. Using the native IDNA implementation or avoiding security decisions based on display_uri output mitigates the risk.