8.8

CVE-2024-12224: servo idna

CVSS: 8.8v3.1HighAnalyzed
AliasesSUSE-RU-2025:02203-1SUSE-RU-2025:02204-1SUSE-SU-2025:02586-1
Published 30-05-2025Last modified 30-05-2025
Open JSON

Vulnerability summary

CVE-2024-12224 is a high (CVSS 8.8) vulnerability in servo idna. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 54 · Related 55
OPENSUSE-SU-2025:15294-1OPENSUSE-SU-2025:15550-1OPENSUSE-SU-2025:15551-1OPENSUSE-SU-2026:20060-1OPENSUSE-SU-2026:20396-1OPENSUSE-SU-2026:21982-1

Timeline

  1. 30-05-2025
    PublishedVulnerability first disclosed.
  2. 30-05-2025
    Last modifiedVulnerability information updated.

Description

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

0.00 pp

From 0.22% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.mozilla.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard62 products
  • atuin< 18.4.0-r0
  • bat< 0.24.0-r5
  • bat-doc< 0.24.0-r5
  • berg< 0.4.7-r0
  • buck2< 20250102-r3
Wolfi60 products
  • atuin< 18.4.0-r0
  • bat< 0.24.0-r5
  • bat-doc< 0.24.0-r5
  • berg< 0.4.7-r0
  • buck2< 20250102-r3
Suse11 products
  • aws-nitro-enclaves-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 1.4.2~git0.6e8512e-150400.3.9.1
  • aws-nitro-enclaves-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 1.4.2~git0.6e8512e-150400.3.9.1
  • aws-nitro-enclaves-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6< 1.4.2~git0.6e8512e-150600.10.6.1
  • aws-nitro-enclaves-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP7< 1.4.2~git0.6e8512e-150600.10.6.1
  • librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 2.57.4-150600.3.3.1
Opensuse9 products
  • afterburn&distro=openSUSE Tumbleweed< 5.9.0.git21.a73f509-2.1
  • aws-nitro-enclaves-cli&distro=openSUSE Leap 15.6< 1.4.2~git0.6e8512e-150600.10.6.1
  • librsvg&distro=openSUSE Leap 15.6< 2.57.4-150600.3.3.1
  • python-nh3&distro=openSUSE Tumbleweed< 0.2.17-2.1
  • python-selenium&distro=openSUSE Tumbleweed< 4.25.0-5.1
Servo2 products
Crates.Io1 product
  • idna< 1.0.0 | ≥ 0.0.0-0, < 1.0.0
Debian1 product
  • rust-idnaAll versions (No fix recorded) | < 1.0.3-2
Ubuntu1 product
  • rust-idnaAll versions (No fix recorded)

8 vendors · 147 products

References

22 links
Show all 22 references