Threats tagged 'brew-travis-cve-2026-126349'

Addressable library versions >= 2.0.0 (pure-Ruby IDNA) and >= 2.5.2 (native IDNA) have an issue where display_uri can show misleading hostnames containing bidirectional and invisible Unicode characters. This can cause malicious domains to appear visually similar to trusted ones in user interfaces that show display_uri, such as link previews or admin panels. The flaw affects only the displayed form, not the actual host parsing or connections. It is fixed in version 2.9.1, where such labels are returned unchanged.