Addressable library versions from 2.0.0 up to but not including 2.9.1 have a vulnerability in the display_uri method where Unicode bidirectional and invisible characters in Punycode-encoded hostnames can cause misleading visual representations. This can make malicious domains appear as trusted ones in user interfaces that show display_uri, such as link previews or email clients. The underlying host parsing and connections are unaffected. The issue is fixed in version 2.9.1.