The story’s score and claims

Comments on No. 18 of 107 · acidvegas · edition of Saturday 7 November 2026

Pushing the Limits with getaddrinfo

Summary

Security researcher acidvegas shows that on Ubuntu 24.04 (glibc 2.39), ping and curl accept IPv4 addresses written with Unicode lookalikes and invisible characters. With AI_IDN set, the name goes through IDNA mapping before the numeric parser, so circled, superscript or segmented digits fold into hex, octal or integer forms of 69.30.206.130. The glibc code ordering was not independently verified. For builders: filters that inspect address strings can be bypassed, so resolve first and check the resulting address.

Comments

Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules