Addressable versions 2.0.0 through 2.9.0 contain a vulnerability in the pure-Ruby IDNA implementation where invalid Punycode A-labels are decoded incorrectly by Addressable::IDNA.to_unicode. This causes the display_uri method to show misleading hostnames that differ from the actual host used in connections, potentially allowing an attacker controlling a domain to impersonate another host visually. The issue is fixed in version 2.9.1. The native IDNA implementation using libidn and the idn-ruby gem is not affected.