Vulnerability · Published May 30, 2025 · Assigned by mozilla
CVE-2024-12224idna accepts Punycode labels that do not produce any non-ASCII when decoded
Medium 5.1
In plain English
A medium-severity security flaw in rust-url from servo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.2%top 86.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | firefox | 140.3.0-1.el8_10.alma.1 | ALSA-2025:16260 |
| AlmaLinux:8 | thunderbird | 140.3.0-1.el8_10.alma.1 | ALSA-2025:16589 |
| Alpine:v3.21 | cargo-modules | 0.21.1-r0 | ALPINE-CVE-2024-12224 |
| Alpine:v3.22 | cargo-modules | 0.21.1-r0 | ALPINE-CVE-2024-12224 |
| Alpine:v3.23 | cargo-modules | 0.21.1-r0 | ALPINE-CVE-2024-12224 |
| Alpine:v3.24 | cargo-modules | 0.21.1-r0 | ALPINE-CVE-2024-12224 |
| Debian:12 | rust-idna | no fix listed | DEBIAN-CVE-2024-12224 |
| Debian:13 | rust-idna | 1.0.3-2 | DEBIAN-CVE-2024-12224 |
| Debian:14 | rust-idna | 1.0.3-2 | DEBIAN-CVE-2024-12224 |
| Ubuntu:22.04:LTS | rust-idna | no fix listed | UBUNTU-CVE-2024-12224 |
| Ubuntu:24.04:LTS | rust-idna | no fix listed | UBUNTU-CVE-2024-12224 |
| Ubuntu:25.10 | rust-idna | no fix listed | UBUNTU-CVE-2024-12224 |
| Ubuntu:26.04:LTS | rust-idna | no fix listed | UBUNTU-CVE-2024-12224 |
| Ubuntu:26.10 | rust-idna | no fix listed | UBUNTU-CVE-2024-12224 |
Affected products (as reported)
Weakness: CWE-1289 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
References
- https://rustsec.org/advisories/RUSTSEC-2024-0421.html vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1887898 issue-tracking