high 8.8

CVE-2024-12224 json

idna accepts Punycode labels that do not produce any non-ASCII when decoded

published 2024-12-09 22 mo ago modified 2026-09-10 1 mo ago also GHSA-h97m-ww89-6jmq , RUSTSEC-2024-0421 , EUVD-2024-3478

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Patch / fix

fixed in 2 distros 6

crates.io idna 1.0.0
servo rust-url 1.0.0

debian red hat suse opensuse almalinux alpine

rust-idna Debian 14, Debian 13 1.0.3-2

debian advisories DEBIAN-CVE-2024-12224

thunderbird RHEL 8 140.3.0-1.el8_10
firefox RHEL 8 140.3.0-1.el8_10
thunderbird RHEL 10.0 140.3.0-1.el10_0
thunderbird RHEL 9 140.3.0-1.el9_6
firefox RHEL 9 140.3.0-1.el9_6
firefox-x11 RHEL 9 140.3.0-1.el9_6
firefox RHEL 10.0 140.3.0-1.el10_0
firefox RHEL 7 ELS 140.3.0-1.el7_9

red hat advisories RHSA-2025:17453 RHSA-2025:17378 RHSA-2025:17374 RHSA-2025:17372 RHSA-2025:17368 RHSA-2025:17371

rustup SLES for SAP applications 16.0, SLES 16.0 1.29.1~0-160000.1.1
sccache SLES for SAP applications 16.0, SLES 16.0 0.18.0~2-160000.1.1
afterburn Linux Micro 6.1 5.10.0.git73.b97f772-slfo.1.1_1.1
afterburn Linux Micro 6.0 5.10.0.git73.b97f772-1.1
sccache SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 0.16.0~0-150600.10.11.1
rustup SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 1.28.2~0-150600.10.13.1
rustup SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.28.2~0-150400.3.13.1
librsvg SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.60.2-160000.1.1

suse advisories SUSE-SU-2026:24014-1 SUSE-SU-2026:23983-1 SUSE-SU-2026:23071-1 SUSE-SU-2026:22917-1 SUSE-SU-2026:3022-1 SUSE-SU-2026:2832-1

rustup openSUSE Leap 16.0 1.29.1~0-160000.1.1
sccache openSUSE Leap 16.0 0.18.0~2-160000.1.1
librsvg openSUSE Leap 16.0 2.60.2-160000.1.1
cargo-c openSUSE Leap 16.0 0.10.15-160000.1.1
sccache openSUSE Tumbleweed 0.12.0~1-1.1
afterburn openSUSE Tumbleweed 5.9.0.git21.a73f509-2.1
cargo-audit openSUSE Tumbleweed 0.21.2~git0.18e58c2-2.1
cargo-c openSUSE Tumbleweed 0.10.3~git0.ee7d7ef-4.1

opensuse advisories openSUSE-SU-2026:22016-1 openSUSE-SU-2026:21982-1 openSUSE-SU-2026:20396-1 openSUSE-SU-2026:20060-1 openSUSE-SU-2025:15656-1 openSUSE-SU-2025:15588-1

thunderbird AlmaLinux 8 140.3.0-1.el8_10.alma.1
firefox AlmaLinux 8 140.3.0-1.el8_10.alma.1

almalinux advisories ALSA-2025:16589 ALSA-2025:16260

cargo-modules Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 0.21.1-r0

alpine advisories ALPINE-CVE-2024-12224

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-12224 updated 2026-11-05 cvss 5.9

idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded

Red Hat OpenShift Serverless openshift-serverless-1/kn-plugin-func-func-util-rhel8
affected: workaround, no fix available
Red Hat Enterprise Linux 6 firefox, thunderbird
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 thunderbird
affected: workaround, no fix available
Red Hat Enterprise Linux 8 mozjs52, mozjs60, rpm-ostree, rpm-ostree-libs
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux 9 gjs, rust, cargo, clippy, rustfmt, librsvg2, +19 more Red Hat Enterprise Linux 10 gjs, netavark, rust-sevctl, fido-device-onboard, trustee-guest-components
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift AI (RHOAI) rhoai/odh-feast-operator-rhel8, rhoai/odh-feature-server-rhel8 Red Hat OpenShift Container Platform 4 coreos-installer, coreos-installer-dracut, coreos-installer-bootinfra Red Hat Satellite 6 python-maturin, python3.12-maturin
affected: workaround, no fix available
Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.3.0-1.el8_10, thunderbird 140.3.0-1.el8_10
fixed: vendor fix RHSA-2025:16260

show 17 more

Red Hat Enterprise Linux AppStream (v. 9) firefox 140.3.0-1.el9_6, firefox-x11 140.3.0-1.el9_6, thunderbird 140.3.0-1.el9_6
fixed: vendor fix RHSA-2025:16108
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.3.0-1.el10_0, thunderbird 140.3.0-1.el10_0
fixed: vendor fix RHSA-2025:16109
Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox 140.3.0-1.el8_2, thunderbird 140.3.0-1.el8_2
fixed: vendor fix RHSA-2025:17372
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.3.0-1.el8_4, thunderbird 140.3.0-1.el8_4
fixed: vendor fix RHSA-2025:17371
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.3.0-1.el8_6, thunderbird 140.3.0-1.el8_6 Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox 140.3.0-1.el8_6, thunderbird 140.3.0-1.el8_6
fixed: vendor fix RHSA-2025:17367
Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.3.0-1.el8_8, thunderbird 140.3.0-1.el8_8
fixed: vendor fix RHSA-2025:17368
Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox 140.3.0-1.el9_0, thunderbird 140.3.0-1.el9_0
fixed: vendor fix RHSA-2025:17373
Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.3.0-1.el9_2, firefox-x11 140.3.0-1.el9_2, thunderbird 140.3.0-1.el9_2
fixed: vendor fix RHSA-2025:17374
Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox 140.3.0-1.el9_4, firefox-x11 140.3.0-1.el9_4, thunderbird 140.3.0-1.el9_4
fixed: vendor fix RHSA-2025:17378
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.3.0-1.el8_4, thunderbird 140.3.0-1.el8_4
fixed: vendor fix RHSA-2025:17371
Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox 140.3.0-1.el8_6, thunderbird 140.3.0-1.el8_6
fixed: vendor fix RHSA-2025:17367
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.3.0-1.el8_8, thunderbird 140.3.0-1.el8_8
fixed: vendor fix RHSA-2025:17368
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.3.0-1.el7_9
fixed: vendor fix RHSA-2025:17453
Red Hat OpenShift AI 2.25 rhoai/odh-feast-operator-rhel9 1791861503, rhoai/odh-feature-server-rhel9 1783544669
fixed: vendor fix RHSA-2026:87410
Red Hat Confidential Compute Attestation confidential-compute-attestation-tech-preview/trustee-rhel9 Red Hat Ansible Automation Platform 2 python3.11-nh3
not affected: vulnerable code not present
Red Hat Enterprise Linux 7 mozjs52
not affected: vulnerable code not in execute path
Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, rustfmt, netavark, +11 more Red Hat Enterprise Linux 9 polkit, netavark, snpguest, polkit-libs, aardvark-dns, keylime-agent-rust Red Hat Enterprise Linux 10 rust, loupe, librsvg2, snpguest, rpm-ostree, aardvark-dns, +4 more Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1784004914, rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1782397826, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1782826282, rhoai/odh-dashboard-rhel9 1791853525, +140 more Red Hat OpenShift Container Platform 4 afterburn, conmon-rs, rpm-ostree, rust-afterburn, kata-containers, rpm-ostree-libs, +1 more Red Hat Trusted Artifact Signer rhtas/tuffer-rhel9, rhtas/tuftool-rhel9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 17 mo ago (2025-05-30)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1887898 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
crates.io	idna	<1.0.0 >=0.0.0-0, <1.0.0	1.0.0

Affected products

servo rust-url

Classification

Weakness

CWE-1289 Improper Validation of Unsafe Equivalence in Input
CWE-352 Cross-Site Request Forgery
CWE-697 Incorrect Comparison

References

bugzilla.mozilla.org /show_bug.cgi?id=1887898
issue-tracking, exploit, web
rustsec.org /advisories/RUSTSEC-2024-0421.html
vendor-advisory, web, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2024-12224
advisory
github.com /servo/rust-url
package
crates.io /crates/idna
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary