AIKIDO-2026-472816

TL;DR

The yarl URL parser and builder APIs accept host inputs that normalize or decode into a different effective host than the raw input or a stricter parser sees. Unicode characters that fold to % under NFKC normalization, IPv6 zone identifiers containing ASCII control characters, and Unicode default-ignorable or format code points can survive host validation and land in url.host, while the Cython and pure-Python quoting backends handle lone surrogates inconsistently. An attacker who supplies a crafted URL can make an application that validates or routes on the parsed host resolve to an unintended host, enabling host confusion and server-side request forgery when the application compares parsed fields against serialized strings. The fix adds % to the _check_netloc NFKC check, validates IPv6 zone identifiers, rejects hosts that expand to URL delimiters or contain default-ignorable code points, and aligns the two quoting backends on lone surrogates.