CVE-2026-57053

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode...

4.0 MediumFix available

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.14%Unchanged since Jun 24, 2026

What each source reports

CVE List Score used 4.0

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: CVE-2026-57053
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-1284
Updated: 2026-11-02

EUVDEUVD-2026-38523 4.0

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: EUVD-2026-38523
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xpv7-vm32-p7wv 4.0

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode...

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: GHSA-xpv7-vm32-p7wv
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-1284
Updated: 2026-11-02

NVD 4.0

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: CVE-2026-57053
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-1284
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-57053 2.5

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: DEBIAN-CVE-2026-57053
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVJLSEC-2026-667 2.5

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs...

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: JLSEC-2026-667
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Show 13 moreShow less

OSVOESA-2026-2932 4.0

libidn security update

GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA 2003 specifications. Libidn's purpose is to encode and decode internationalized domain names.

Security Fix(es):

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.(CVE-2026-57053)

Record: OESA-2026-2932
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVOESA-2026-2933 4.0

libidn security update

GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA 2003 specifications. Libidn's purpose is to encode and decode internationalized domain names.

Security Fix(es):

Record: OESA-2026-2933
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVOESA-2026-2934 4.0

libidn security update

GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA 2003 specifications. Libidn's purpose is to encode and decode internationalized domain names.

Security Fix(es):

Record: OESA-2026-2934
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVOESA-2026-2935 4.0

libidn security update

GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA 2003 specifications. Libidn's purpose is to encode and decode internationalized domain names.

Security Fix(es):

Record: OESA-2026-2935
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVOESA-2026-2983 4.0

libidn security update

GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA 2003 specifications. Libidn's purpose is to encode and decode internationalized domain names.

Security Fix(es):

Record: OESA-2026-2983
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2026:42125 2.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:42125
CVSS 3.1: 2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-57053 4.0

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Record: UBUNTU-CVE-2026-57053
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVMGASA-2026-0262 No score

Updated libidn packages fix security vulnerability

Record: MGASA-2026-0262
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21758-1 No score

Security update for libidn

This update for libidn fixes the following issue:

CVE-2026-57053: out-of-bounds read in ToUnicode APIs (bsc#1268965).

Record: openSUSE-SU-2026:21758-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23621-1 No score

Security update for libidn

This update for libidn fixes the following issue:

CVE-2026-57053: out-of-bounds read in ToUnicode APIs (bsc#1268965).

Record: SUSE-SU-2026:23621-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4000-1 No score

Security update for libidn

This update for libidn fixes the following issue:

CVE-2026-57053: out-of-bounds read in ToUnicode APIs (bsc#1268965).

Record: SUSE-SU-2026:4000-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4081-1 No score

Security update for libidn

This update for libidn fixes the following issue:

CVE-2026-57053: out-of-bounds read in ToUnicode APIs (bsc#1268965).

Record: SUSE-SU-2026:4081-1
Updated: 2026-11-02

OSVUSN-8521-1 No score

libidn vulnerability

It was discovered that Libidn incorrectly handled certain internationalized domain name strings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service.

Record: USN-8521-1
Updated: 2026-11-02

Affected products

gnu libidn

Affected packages

Affected packages
Package	Affected	Fixed
`libidn` Debian:12	All versions, plus listed versions 1.41-11.42-11.42-21.42-31.43-11.43-21.43-31.44-1	None known
`libidn` Debian:13	All versions, plus listed versions 1.43-11.43-21.43-31.44-1	None known
`libidn` Debian:14	before 1.44-1, plus listed versions 1.43-11.43-21.43-3	1.44-1
`libidn_jll` Julia	before 1.44.0+0	1.44.0+0
`libidn` Mageia:10	before 1.43-2.1.mga10	1.43-2.1.mga10
`libidn` Mageia:9	before 1.41-2.1.mga9	1.41-2.1.mga9
`libidn` openEuler:24.03-LTS-SP1	before 1.41-2.oe2403sp1	1.41-2.oe2403sp1
`libidn` openEuler:24.03-LTS-SP3	before 1.41-2.oe2403sp3	1.41-2.oe2403sp3
`libidn` openEuler:20.03-LTS-SP4	before 1.36-4.oe2003sp4	1.36-4.oe2003sp4
`libidn` openEuler:22.03-LTS-SP4	before 1.41-2.oe2203sp4	1.41-2.oe2203sp4

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`libidn` openEuler:24.03-LTS-SP4	before 1.41-2.oe2403sp4	1.41-2.oe2403sp4
`idn2` Red Hat:hummingbird:1	before 0:2.3.8-4.hum1	0:2.3.8-4.hum1
`libidn2` Red Hat:hummingbird:1	before 0:2.3.8-4.hum1	0:2.3.8-4.hum1
`libidn2-devel` Red Hat:hummingbird:1	before 0:2.3.8-4.hum1	0:2.3.8-4.hum1
`libidn` SUSE:Linux Enterprise Server 16.0	before 1.43-160000.3.1	1.43-160000.3.1
`libidn` SUSE:Linux Enterprise Server for SAP applications 16.0	before 1.43-160000.3.1	1.43-160000.3.1
`libidn` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 1.34-150000.3.5.1	1.34-150000.3.5.1
`libidn` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 1.28-5.9.1	1.28-5.9.1
`libidn` Ubuntu:14.04:LTS	All versions, plus listed versions 1.28-1ubuntu11.28-1ubuntu21.28-1ubuntu2.11.28-1ubuntu2.2	None known
`libidn` Ubuntu:16.04:LTS	All versions, plus listed versions 1.28-1ubuntu21.32-3ubuntu11.32-3ubuntu1.11.32-3ubuntu1.2	None known
`libidn` Ubuntu:18.04:LTS	All versions, plus listed versions 1.33-21.33-2.11.33-2.1ubuntu11.33-2.1ubuntu1.11.33-2.1ubuntu1.2	None known
`libidn` Ubuntu:20.04:LTS	All versions, plus listed versions 1.33-2.2ubuntu2	None known
`libidn` Ubuntu:22.04:LTS	before 1.38-4ubuntu1.1, plus listed versions 1.33-31.33-3build11.38-41.38-4build11.38-4ubuntu1	1.38-4ubuntu1.1
`libidn` Ubuntu:24.04:LTS	before 1.42-1ubuntu0.1, plus listed versions 1.41-11.42-11.42-1build1	1.42-1ubuntu0.1
`libidn` Ubuntu:25.10	All versions, plus listed versions 1.43-11.43-2	None known
`libidn` Ubuntu:26.04:LTS	before 1.43-2ubuntu0.26.04.1, plus listed versions 1.43-21.43-2build1	1.43-2ubuntu0.26.04.1
`libidn` openSUSE:Leap 16.0	before 1.43-160000.3.1	1.43-160000.3.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57053 is a medium vulnerability (CVSS 4.0) in Gnu Libidn, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in libidn 1.44-1.

References

Show 22 moreShow less