FlawAtlas
Search the atlas
CVE-2024-12224 Not scored

idna accepts Punycode labels that do not produce any non-ASCII when decoded

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Exploit probability 0.2%
Published May 30, 2025
Required by Not available
Last source change July 16, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

42 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:15201-1
related OPENSUSE-SU-2025:15202-1
related OPENSUSE-SU-2025:15294-1
related OPENSUSE-SU-2025:15353-1
related OPENSUSE-SU-2025:15550-1
related OPENSUSE-SU-2025:15551-1
related OPENSUSE-SU-2025:15588-1
related OPENSUSE-SU-2025:15656-1
related OPENSUSE-SU-2026:20060-1
related OPENSUSE-SU-2026:20396-1
related SUSE-RU-2025:02203-1
related SUSE-RU-2025:02204-1
related SUSE-SU-2025:02586-1
related SUSE-SU-2025:02587-1
related SUSE-SU-2025:02768-1
related SUSE-SU-2025:02809-1
related SUSE-SU-2025:02810-1
related SUSE-SU-2025:02811-1
related SUSE-SU-2025:03298-1
related SUSE-SU-2025:03306-1
related SUSE-SU-2025:03307-1
related SUSE-SU-2025:03445-1
related SUSE-SU-2025:20491-1
related SUSE-SU-2025:20716-1
related SUSE-SU-2025:20783-1
related SUSE-SU-2025:20858-1
related SUSE-SU-2025:3783-1
related SUSE-SU-2025:3784-1
related SUSE-SU-2025:3785-1
related SUSE-SU-2025:3786-1
related SUSE-SU-2025:4411-1
related SUSE-SU-2026:0243-1
related SUSE-SU-2026:0620-1
related SUSE-SU-2026:20096-1
related SUSE-SU-2026:20755-1
related SUSE-SU-2026:20910-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2024-12224

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

View original source

05 / REFERENCES

Further evidence