idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c Patch, Third Party Advisory
- https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · gnuNVD modified 2026-10-14 07:16
Affected (CPE criteria) 1
cpe:2.3:a:gnu:libidn2:*:*:*:*:*:*:*:*
References 23
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c Patch, Third Party Advisory
- https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1 Release Notes, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/
- https://seclists.org/bugtraq/2020/Feb/4
- https://security.gentoo.org/glsa/202003-63
- https://usn.ubuntu.com/4168-1/
- https://www.debian.org/security/2020/dsa-4613
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c Patch, Third Party Advisory
- https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1 Release Notes, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/
- https://seclists.org/bugtraq/2020/Feb/4
- https://security.gentoo.org/glsa/202003-63
- https://usn.ubuntu.com/4168-1/
- https://www.debian.org/security/2020/dsa-4613
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html