idna accepts Punycode labels that do not produce any non-ASCII when decoded
Priority MEDIUM 56CWE-1289Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Partial Red Hat: 16 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.
Summary
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rust-url (servo): 1.0.0idna (crates.io): 1.0.0Red Hat: 23 advisoriesRed Hat: 16 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| servo | rust-url | before 1.0.0 | 1.0.0 | Patch available | CNA |
| — | idna (crates.io) | before 1.0.0 | 1.0.0 | Patch available | GHSA-h97m-ww89-6jmq |
- rust-url Vendorservo Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
- idna (crates.io) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-h97m-ww89-6jmq
Remediation
- Fix · CNA rust-url (servo) Fixed in 1.0.0
- Fix · GHSA-h97m-ww89-6jmq idna (crates.io) Fixed in 1.0.0 Advisory →
Red Hat 23 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:42644 Released 2026-07-21 · Red Hat rating ImportantRHOAI 2.25.9 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
- RHSA-2025:17453 Released 2025-10-07 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux Server (v. 7 ELS) firefox-140.3.0-1.el7_9
Show 20 more Red Hat advisories
- RHSA-2025:17378 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox-140.3.0-1.el9_4, firefox-x11-140.3.0-1.el9_4
- RHSA-2025:17374 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox-140.3.0-1.el9_2, firefox-x11-140.3.0-1.el9_2
- RHSA-2025:17373 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-140.3.0-1.el9_0
- RHSA-2025:17371 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-140.3.0-1.el8_4
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox-140.3.0-1.el8_4
- RHSA-2025:17372 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-140.3.0-1.el8_2
- RHSA-2025:17367 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox-140.3.0-1.el8_6
- Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox-140.3.0-1.el8_6
- Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox-140.3.0-1.el8_6
- RHSA-2025:17368 Released 2025-10-06 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox-140.3.0-1.el8_8
- Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox-140.3.0-1.el8_8
- RHSA-2025:17346 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) thunderbird-140.3.0-1.el9_4
- RHSA-2025:17345 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) thunderbird-140.3.0-1.el9_2
- RHSA-2025:17343 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) thunderbird-140.3.0-1.el8_8
- Red Hat Enterprise Linux AppStream TUS (v.8.8) thunderbird-140.3.0-1.el8_8
- RHSA-2025:17344 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) thunderbird-140.3.0-1.el9_0
- RHSA-2025:17342 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird-140.3.0-1.el8_6
- Red Hat Enterprise Linux AppStream E4S (v.8.6) thunderbird-140.3.0-1.el8_6
- Red Hat Enterprise Linux AppStream TUS (v.8.6) thunderbird-140.3.0-1.el8_6
- RHSA-2025:17340 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-140.3.0-1.el8_2
- RHSA-2025:17341 Released 2025-10-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-140.3.0-1.el8_4
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) thunderbird-140.3.0-1.el8_4
- RHSA-2025:16589 Released 2025-09-24 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-140.3.0-1.el8_10
- RHSA-2025:16260 Released 2025-09-22 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 8) firefox-140.3.0-1.el8_10
- RHSA-2025:16157 Released 2025-09-18 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 10) thunderbird-140.3.0-1.el10_0
- RHSA-2025:16156 Released 2025-09-18 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 9) thunderbird-140.3.0-1.el9_6
- RHSA-2025:16108 Released 2025-09-17 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 9) firefox-140.3.0-1.el9_6, firefox-x11-140.3.0-1.el9_6
- RHSA-2025:16109 Released 2025-09-17 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 10) firefox-140.3.0-1.el10_0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Trusted Profile Analyzer | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:16109, RHSA-2025:16157 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:16260, RHSA-2025:16589 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:16108, RHSA-2025:16156 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:17340, RHSA-2025:17372 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:17341, RHSA-2025:17371 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:17342, RHSA-2025:17367 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:17342, RHSA-2025:17367 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:17343, RHSA-2025:17368 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:17344, RHSA-2025:17373 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:17345, RHSA-2025:17374 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:17346, RHSA-2025:17378 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:17341, RHSA-2025:17371 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:17342, RHSA-2025:17367 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:17343, RHSA-2025:17368 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:17453 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:42644, RHSA-2026:87410 |
Not affected: 9 products
- Confidential Compute Attestation
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift Container Platform 4
- Red Hat Trusted Artifact Signer
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12224
- 2026-10-03 Alias added: GHSA-h97m-ww89-6jmq
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat
References
Sources
- CVE-2024-12224 · CVE Program
- CVE-2024-12224 · NVD
- FIRST EPSS
- GHSA-h97m-ww89-6jmq · GitHub Advisory Database · CC BY 4.0
- CVE-2024-12224 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences