CVE-2024-12224 idna accepts Punycode labels that do not produce any non-ASCII when decoded
Attackers can create Punycode hostnames that bypass security checks by exploiting inconsistent IDNA decoding in the Rust idna crate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-12224?
CVE-2024-12224 is a medium-severity vulnerability in servo rust-url, published on 30 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
Which versions are affected by CVE-2024-12224?
3 open source packages ship an affected version, including idna. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
idna crates.io | All versions | 1.0.0 |
idna crates.io | All versions | 1.0.0 |
idna crates.io | From 0.0.0-0 | 1.0.0 |
Linux distribution packages (20)
rav1e SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 0.6.6-150600.3.3.1 |
librsvg SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.57.4-150600.3.3.1 |
rav1e SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 0.6.6-150600.3.3.1 |
librsvg SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 2.57.4-150600.3.3.1 |
sccache SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 0.4.2~4-150600.10.3.1 |
sccache SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 0.4.2~4-150600.10.3.1 |
aws-nitro-enclaves-cli SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 1.4.2~git0.6e8512e-150400.3.9.1 |
aws-nitro-enclaves-cli SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 1.4.2~git0.6e8512e-150400.3.9.1 |
aws-nitro-enclaves-cli SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 1.4.2~git0.6e8512e-150600.10.6.1 |
aws-nitro-enclaves-cli SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | All versions | 1.4.2~git0.6e8512e-150600.10.6.1 |
rust-keylime SUSE:Linux Micro 6.0 | All versions | 0.2.7+70-1.1 |
aws-nitro-enclaves-cli openSUSE:Leap 15.6 | All versions | 1.4.2~git0.6e8512e-150600.10.6.1 |
librsvg openSUSE:Leap 15.6 | All versions | 2.57.4-150600.3.3.1 |
rav1e openSUSE:Leap 15.6 | All versions | 0.6.6-150600.3.3.1 |
sccache openSUSE:Leap 15.6 | All versions | 0.4.2~4-150600.10.3.1 |
afterburn openSUSE:Tumbleweed | All versions | 5.9.0.git21.a73f509-2.1 |
python-nh3 openSUSE:Tumbleweed | All versions | 0.2.17-2.1 |
python-selenium openSUSE:Tumbleweed | All versions | 4.25.0-5.1 |
rustup openSUSE:Tumbleweed | All versions | 1.28.2~0-1.1 |
sccache openSUSE:Tumbleweed | All versions | 0.12.0~1-1.1 |
Products include Servo Idna.
How do I fix CVE-2024-12224?
Upgrade idna to 1.0.0 or later.
Is CVE-2024-12224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12224 exists.
Sources
Also known as DEBIAN-CVE-2024-12224, GHSA-h97m-ww89-6jmq, MINI-4f9h-74xv-8mmp, OESA-2026-3013, RUSTSEC-2024-0421, SUSE-RU-2025:02203-1 and 12 more.