CVE-2026-126349 Addressable display_uri can show misleading hosts containing bidi and invisible characters
Attackers can craft Punycode hostnames that make Addressable show misleading hosts, enabling spoofing of trusted URLs in Ruby apps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-126349?
CVE-2026-126349 is a low-severity security feature bypass vulnerability in sporkmonger addressable, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.
Which versions are affected by CVE-2026-126349?
1 open source package ship an affected version, including addressable.
An affected version is only exploitable if your software calls Addressable::IDNA.to_unicode or Addressable::URI#display_uri. Many projects that include it are not exposed.
| Package | Affected | Fixed in |
|---|---|---|
addressable RubyGems | From 2.0.0 | 2.9.1 |
How do I fix CVE-2026-126349?
Upgrade addressable to 2.9.1 or later.
Upgrade to the fixed version, and do not rely on a single control for protection. More about Security feature bypass.
Is CVE-2026-126349 being exploited?
There is no known exploitation of CVE-2026-126349 in the wild and no public exploit code.
Sources
Also known as GHSA-539f-xcgw-2gjg.