CVE-2024-12224: Servo Idna

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Affected products

• Servo Idna: before 1.0.0 (fixed in 1.0.0)

Published 2025-05-30. Last modified 2026-06-17.