CWE-1007 vulnerabilities

Addressable, a Ruby library for URI handling, has a vulnerability in versions from 2.0.0 up to but not including 2.9.1 where its IDNA to_unicode method improperly handles Unicode encoding. This allows decoding of Punycode labels containing bidirectional controls, zero-width, control, or default-ignorable characters, potentially causing visually misleading hostnames. The issue is fixed in version 2.9.1.

Addressable, a Ruby library for URI handling, has an improper input validation vulnerability in its pure-Ruby IDNA to_unicode implementation from versions 2.0.0 up to but not including 2.9.1. This flaw causes invalid Punycode A-labels to be decoded incorrectly, allowing the display of a trusted-looking host while the actual connection target remains attacker-controlled. This discrepancy can lead to trusted-name comparison errors. The issue is fixed in version 2.9.1.