CVE-2024-12224

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1289CWE-352

Affected software

VendorProductVersions
servorust-url< 1.0.0

References

Timeline

Published
May 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-122259.1A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints fCVE-2024-122266.5In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cleCVE-2024-122275.5A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpaCVE-2024-122289.8A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 1.0. Affected is an unknown function of the CVE-2024-122299.8A vulnerability classified as critical was found in PHPGurukul Complaint Management System 1.0. Affected by this vulnerability is an unknownCVE-2024-12234.8This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have eCVE-2024-122309.8A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 1.0. Affected by this issue is sCVE-2024-122319.8A vulnerability, which was classified as critical, was found in CodeZips Project Management System 1.0. This affects an unknown part of the CVE-2024-122326.1A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknCVE-2024-122339.8A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processCVE-2024-122349.8A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown CVE-2024-122358.8A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected