Every CVE Search/ Get API key

CVE-2019-18224

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via...

9.8 CriticalFix available

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.71%Up 1.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
CVE-2019-18224
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
CVE-2019-18224
Updated
2026-11-02
EUVDEUVD-2019-8024 No score

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
EUVD-2019-8024
Updated
2026-11-02
GitHub AdvisoriesGHSA-j2c9-63g7-697x 9.8

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via...

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
GHSA-j2c9-63g7-697x
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-18224 9.8

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
ALPINE-CVE-2019-18224
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2019-18224 9.8

CVE-2019-18224 does not affect BellSoft software

Record
BELL-CVE-2019-18224
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSV 9.8

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
CVE-2019-18224
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-18224 9.8

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
DEBIAN-CVE-2019-18224
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHBA-2019:3621 5.6

Red Hat Bug Fix Advisory: libidn2 bug fix and enhancement update

Record
RHBA-2019:3621
CVSS 3.0
5.6 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-18224 9.8

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Record
UBUNTU-CVE-2019-18224
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALBA-2019:3621 No score

libidn2 bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALBA-2019:3621
Updated
2026-11-02
OSVMGASA-2019-0416 No score

Updated libidn2 packages fix security vulnerabilities

Updated libidn2 packages fix security vulnerabilities:

It was discovered that Libidn2 incorrectly handled certain inputs. A attacker could possibly use this issue to impersonate domains (CVE-2019-12290).

It was discovered that Libidn2 incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code (CVE-2019-18224).

Record
MGASA-2019-0416
Updated
2026-11-02
OSVopenSUSE-SU-2019:2611-1 No score

Security update for libidn2

This update for libidn2 to version 2.2.0 fixes the following issues:

  • CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884).
  • CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2611-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2613-1 No score

Security update for libidn2

This update for libidn2 to version 2.2.0 fixes the following issues:

  • CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884).
  • CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2613-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10950-1 No score

libidn2-0-2.3.2-1.2 on GA media

These are all security issues fixed in the libidn2-0-2.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10950-1
Updated
2026-11-02
OSVSUSE-SU-2019:3086-1 No score

Security update for libidn2

This update for libidn2 to version 2.2.0 fixes the following issues:

  • CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884).
  • CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887).
Record
SUSE-SU-2019:3086-1
Updated
2026-11-02
OSVUSN-4168-1 No score

libidn2 vulnerabilities

It was discovered that Libidn2 incorrectly handled certain inputs. A attacker could possibly use this issue to impersonate domains. (CVE-2019-12290)

It was discovered that Libidn2 incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-18224)

Record
USN-4168-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
idn2
AlmaLinux:8
 before 2.2.0-1.el8
2.2.0-1.el8
libidn2
AlmaLinux:8
 before 2.2.0-1.el8
2.2.0-1.el8
libidn2-devel
AlmaLinux:8
 before 2.2.0-1.el8
2.2.0-1.el8
libidn2
Alpine:v3.12
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.13
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.14
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.15
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.16
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.17
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.18
 before 2.1.1-r0
2.1.1-r0
Show 31 moreShow less
Affected packages
PackageAffectedFixed
libidn2
Alpine:v3.19
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.20
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.21
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.22
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.23
 before 2.1.1-r0
2.1.1-r0
libidn2
Alpine:v3.24
 before 2.1.1-r0
2.1.1-r0
libidn2
Debian:12
 before 2.2.0-1
2.2.0-1
libidn2
Debian:13
 before 2.2.0-1
2.2.0-1
libidn2
Debian:14
 before 2.2.0-1
2.2.0-1
libidn2
Debian:10
 before 2.0.5-1+deb10u1, plus listed versions
2.0.5-1
2.0.5-1+deb10u1
libidn2
Mageia:7
From an advisory covering 2 CVEs
 before 2.2.0-1.mga7
2.2.0-1.mga7
idn2
Red Hat:enterprise_linux:8::appstream
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
idn2-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
idn2-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
idn2-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2-devel
Red Hat:enterprise_linux:8::crb
 before 0:2.2.0-1.el8
0:2.2.0-1.el8
libidn2
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 2 CVEs
 before 2.2.0-3.3.1
2.2.0-3.3.1
libidn2
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 2 CVEs
 before 2.2.0-3.3.1
2.2.0-3.3.1
libidn2-0
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.9-10.9-1ubuntu0.1~esm1
 None known
libidn2-0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.10-30.10-3ubuntu0.1~esm1
 None known
libidn2
Ubuntu:18.04:LTS
 before 2.0.4-1.1ubuntu0.2, plus listed versions
2.0.4-12.0.4-1.12.0.4-1.1build2
2.0.4-1.1ubuntu0.2
libidn2
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 2.0.4-1.1ubuntu0.2, plus listed versions
2.0.4-12.0.4-1.12.0.4-1.1build2
2.0.4-1.1ubuntu0.2
libidn2
openSUSE:Leap 15.1
From an advisory covering 2 CVEs
 before 2.2.0-lp151.3.3.1
2.2.0-lp151.3.3.1
libidn2
openSUSE:Leap 15.0
From an advisory covering 2 CVEs
 before 2.2.0-lp150.2.3.1
2.2.0-lp150.2.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-18224 is a critical vulnerability (CVSS 9.8) in Gnu Libidn2, published October 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.71%, the 89th percentile. Fixed in idn2 2.2.0-1.el8.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open