Threats tagged 'brew-uffizzi-cve-2026-126348'

A vulnerability in the Addressable Ruby library's pure-Ruby IDNA implementation allows certain invalid Punycode A-labels to be decoded incorrectly by the to_unicode method. This causes display_uri to show misleading hostnames that differ from the actual host used in connections, potentially enabling attackers controlling a domain to impersonate other hosts in displayed URIs. The issue affects Addressable versions 2.0.0 and later when using the pure-Ruby implementation and is fixed in version 2.9.1. The native IDNA implementation is not affected.