CVE-2016-9179

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the...

7.5 HighFix available

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

2.00%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: CVE-2016-9179
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: CVE-2016-9179
Updated: 2026-11-02

EUVDEUVD-2016-9995 No score

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: EUVD-2016-9995
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r2wx-qjhc-7h6p 7.5

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the...

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: GHSA-r2wx-qjhc-7h6p
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSV 7.5

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: CVE-2016-9179
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-9179 7.5

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: DEBIAN-CVE-2016-9179
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2016-9179 7.5

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Record: UBUNTU-CVE-2016-9179
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVMGASA-2017-0052 No score

Updated lynx packages fix security vulnerability

Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. (CVE-2016-9179)

Record: MGASA-2017-0052
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11033-1 No score

lynx-2.9.0~dev.9-1.2 on GA media

These are all security issues fixed in the lynx-2.9.0~dev.9-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11033-1
Updated: 2026-11-02

OSVSUSE-SU-2017:0599-1 No score

Security update for lynx

This update for lynx fixes the following issues:

CVE-2016-9179: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. (bsc#1008642)

Record: SUSE-SU-2017:0599-1
Updated: 2026-11-02

OSVUSN-4800-1 No score

lynx vulnerabilities

It was discovered that Lynx incorrectly handled certain URLs. A remote attacker could possibly use this issue to obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-9179)

It was discovered that Lynx incorrectly handled certain HTML files. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000211)

Thorsten Glaser discovered that Lynx mishandles the userinfo subcomponents of a URI. An attacker monitoring the network could discover cleartext credentials because they may appear in SNI data. (CVE-2021-38165)

Record: USN-4800-1
Updated: 2026-11-02

Affected products

lynx

Affected packages

Affected packages
Package	Affected	Fixed
`lynx` Debian:12	before 2.8.9dev11-1	2.8.9dev11-1
`lynx` Debian:13	before 2.8.9dev11-1	2.8.9dev11-1
`lynx` Debian:14	before 2.8.9dev11-1	2.8.9dev11-1
`lynx-cur` Debian:7	before 2.8.8dev.12-2+deb7u1, plus listed versions 2.8.8dev.12-2	2.8.8dev.12-2+deb7u1
`lynx` Mageia:5	before 2.8.8-1.rel2.3.1.mga5	2.8.8-1.rel2.3.1.mga5
`lynx` SUSE:Linux Enterprise Software Development Kit 11 SP4	before 2.8.6-145.1	2.8.6-145.1
`lynx` Ubuntu:Pro:16.04:LTS	before 2.8.9dev8-4ubuntu1+esm1, plus listed versions 2.8.9dev8-4ubuntu1	2.8.9dev8-4ubuntu1+esm1
`lynx` Ubuntu:Pro:16.04:LTS	before 2.8.9dev8-4ubuntu1+esm2, plus listed versions 2.8.9dev8-4ubuntu12.8.9dev8-4ubuntu1+esm1	2.8.9dev8-4ubuntu1+esm2
`lynx` Ubuntu:Pro:18.04:LTS	before 2.8.9dev16-3ubuntu0.1~esm1, plus listed versions 2.8.9dev16-12.8.9dev16-22.8.9dev16-3	2.8.9dev16-3ubuntu0.1~esm1
`lynx` Ubuntu:Pro:20.04:LTS	before 2.9.0dev.5-1ubuntu0.1~esm1, plus listed versions 2.9.0dev.4-12.9.0dev.5-1	2.9.0dev.5-1ubuntu0.1~esm1
`lynx` openSUSE:Tumbleweed	before 2.9.0~dev.9-1.2	2.9.0~dev.9-1.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9179 is a high vulnerability (CVSS 7.5) in Lynx, published November 24, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 80th percentile. Fixed in lynx 2.8.9dev11-1.

References

Show 11 moreShow less