Every CVE Search/ Get API key

CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content...

4.3 MediumFix available

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Exploit likelihood

2.60%Down 1.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Record
CVE-2007-5034
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Record
CVE-2007-5034
Updated
2026-11-02
EUVDEUVD-2007-5015 No score

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Record
EUVD-2007-5015
Updated
2026-11-03
GitHub AdvisoriesGHSA-ff3h-vr24-34v2 No score

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content...

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Record
GHSA-ff3h-vr24-34v2
Weakness
CWE-200
Updated
2026-11-02
OSV No score

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Record
CVE-2007-5034
Updated
2026-11-02
OSVDEBIAN-CVE-2007-5034 No score

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Record
DEBIAN-CVE-2007-5034
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
elinks
Debian:12
 before 0.11.1-1.5
0.11.1-1.5
elinks
Debian:13
 before 0.11.1-1.5
0.11.1-1.5
elinks
Debian:14
 before 0.11.1-1.5
0.11.1-1.5
elinks
Debian:4.0
 before 0.11.1-1.2etch1, plus listed versions
0.11.1-1.2
0.11.1-1.2etch1
elinks
Red Hat:enterprise_linux:4::as
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks
Red Hat:enterprise_linux:4::es
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
Show 6 moreShow less
Affected packages
PackageAffectedFixed
elinks
Red Hat:enterprise_linux:4::ws
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:0.9.2-3.3.5.2
0:0.9.2-3.3.5.2
elinks
Red Hat:enterprise_linux:5::client
 before 0:0.11.1-5.1.0.1.el5
0:0.11.1-5.1.0.1.el5
elinks-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.11.1-5.1.0.1.el5
0:0.11.1-5.1.0.1.el5
elinks
Red Hat:enterprise_linux:5::server
 before 0:0.11.1-5.1.0.1.el5
0:0.11.1-5.1.0.1.el5
elinks-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.11.1-5.1.0.1.el5
0:0.11.1-5.1.0.1.el5

History

History
RecordedChangedSources
aliasesEUVD
affected, aliases, facts, references, titleGitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-5034 is a medium vulnerability (CVSS 4.3) in Elinks, published September 21, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.60%, the 85th percentile. Fixed in elinks 0.11.1-1.5.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open