{"id":"CVE-2021-38165","aliases":["ALPINE-CVE-2021-38165","ALSA-2022:2129","DEBIAN-CVE-2021-38165","DLA-2736-1","DSA-4953-1","EUVD-2021-24635","GHSA-88f3-hp86-v36f","MGASA-2021-0422","OESA-2021-1326","RHSA-2022:2129","RLSA-2022:2129","UBUNTU-CVE-2021-38165","USN-4800-1"],"status":"published","title":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers...","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03944,"percentile":0.9054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2021-03-15T21:24:24Z","modified":"2026-10-29T11:01:06Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"lynx","fixed_in":["2.8.9_p1-r3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lynx","fixed_in":["2.8.9-4.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lynx","fixed_in":["2.9.0dev.6-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lynx","fixed_in":["2.9.0dev.6-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lynx","fixed_in":["2.9.0dev.6-3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lynx","fixed_in":["2.8.9dev11-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"lynx","fixed_in":["2.8.9rel.1-3+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"lynx","fixed_in":["2.8.9-0.dev17.4.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"lynx","fixed_in":["2.8.9-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"lynx","fixed_in":["2.8.9-6.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lynx","fixed_in":["0:2.8.9-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lynx-debuginfo","fixed_in":["0:2.8.9-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lynx-debugsource","fixed_in":["0:2.8.9-4.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"lynx","fixed_in":["0:2.8.9-4.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lynx","fixed_in":["2.8.9dev8-4ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lynx","fixed_in":["2.8.9dev16-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lynx","fixed_in":["2.9.0dev.5-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9_p1-r3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-4.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0dev.6-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0dev.6-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0dev.6-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev11-1+deb9u1"}]}],"versions":["2.8.9dev11-1"]},{"source":"osv","ecosystem":"Debian:10","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9rel.1-3+deb10u1"}]}],"versions":["2.8.9rel.1-3"]},{"source":"osv","ecosystem":"Mageia:8","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-0.dev17.4.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-6.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.9-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.9-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lynx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.9-4.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.9-4.el8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev8-4ubuntu1+esm2"}]}],"versions":["2.8.9dev8-4ubuntu1","2.8.9dev8-4ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev16-3ubuntu0.1~esm1"}]}],"versions":["2.8.9dev16-1","2.8.9dev16-2","2.8.9dev16-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0dev.5-1ubuntu0.1~esm1"}]}],"versions":["2.9.0dev.4-1","2.9.0dev.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev8-4ubuntu1+esm2"}]}],"versions":["2.8.9dev8-4ubuntu1","2.8.9dev8-4ubuntu1+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev16-3ubuntu0.1~esm1"}]}],"versions":["2.8.9dev16-1","2.8.9dev16-2","2.8.9dev16-3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0dev.5-1ubuntu0.1~esm1"}]}],"versions":["2.9.0dev.4-1","2.9.0dev.5-1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"lynx_project","product":"lynx"}],"references":[{"url":"https://bugs.debian.org/991971","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/08/07/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://lynx.invisible-island.net/current/CHANGES.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/08/07/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/08/07/11","tags":["x_refsource_MISC","x_transferred","Mailing List","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/08/07/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/08/07/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4953","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKNK7GQBJBUBMJVNKVC7RTCYWUYMFJQW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6PZF7JNTFCOJ62HXZG4Q2NEHSZ6IO2V/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38165","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K6PZF7JNTFCOJ62HXZG4Q2NEHSZ6IO2V/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKNK7GQBJBUBMJVNKVC7RTCYWUYMFJQW/"},{"url":"https://www.openwall.com/lists/oss-security/2021/08/07/7"},{"url":"https://github.com/advisories/GHSA-88f3-hp86-v36f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-38165","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-2129.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-38165","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38165","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0422.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29342","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/08/07/9","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1326","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:2129","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994998","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2129.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38165","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:2129","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38165","tags":["report"]},{"url":"https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html","tags":["report"]},{"url":"https://lynx.invisible-island.net/current/CHANGES.html#v2.9.0dev.9","tags":["report"]},{"url":"https://invisible-mirror.net/archives/lynx/patches/lynx2.9.0dev.9.patch.gz","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4800-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000211","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-38165","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T17:33:54Z","modified":"2024-08-04T01:37:16.277Z","updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2021-24635","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T17:33:54Z","modified":"2024-08-04T01:37:16Z","updated_at":"2026-11-03T03:24:25.244479Z"}],"ghsa":[{"id":"GHSA-88f3-hp86-v36f","title":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers...","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2022-05-24T19:10:20Z","modified":"2023-01-30T05:01:15Z","cwes":["CWE-522"],"updated_at":"2026-11-02T14:46:22.480874Z"}],"nvd":[{"id":"CVE-2021-38165","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T18:15:06.997Z","modified":"2026-06-17T04:01:39.683Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-38165","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T18:15:06.997Z","modified":"2026-10-23T17:17:56.205968987Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"CVE-2021-38165","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T18:15:06.997Z","modified":"2026-04-16T04:39:35.196819712Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-38165","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T18:15:06.997Z","modified":"2026-10-23T18:03:31.49400997Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1326","title":"lynx security update","description":"Lynx is a fully-featured World Wide Web (WWW) client for users running cursor-addressable, character-cell display devices such as vt100 terminals, vt100 emulators running on Windows 95/NT or Macintoshes, or any other character-cell display.  It will display Hypertext Markup Language (HTML) documents containing links to files on the local system, as well as files on remote systems running http, gopher, ftp, wais, nntp, finger, or cso/ph/qi servers, and services accessible via logins to telnet, tn3270 or rlogin accounts.  Current versions of Lynx run on Unix, VMS, Windows95 through Windows 8, 386DOS and OS/2 EMX.\r\n\r\nSecurity Fix(es):\r\n\r\nLynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.(CVE-2021-38165)","status":"published","published":"2021-08-28T11:04:34Z","modified":"2026-08-18T01:15:57.424596438Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:2129","title":"Red Hat Security Advisory: lynx security update","status":"published","published":"2024-09-13T17:36:42Z","modified":"2026-06-29T10:41:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:2129","title":"Moderate: lynx security update","description":"Lynx is a text-based Web browser. Lynx does not display any images, but it does support frames, tables, and most other HTML tags.\n\nSecurity Fix(es):\n\n* lynx: Disclosure of HTTP authentication credentials via SNI data (CVE-2021-38165)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2026-06-28T00:01:40.098233Z","modified":"2026-06-28T00:30:04.292863031Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-38165","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","status":"published","published":"2021-08-07T18:15:00Z","modified":"2026-02-04T02:31:47.139777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"ALSA-2022:2129","title":"Moderate: lynx security update","description":"Lynx is a text-based Web browser. Lynx does not display any images, but it does support frames, tables, and most other HTML tags.\n\nSecurity Fix(es):\n\n* lynx: Disclosure of HTTP authentication credentials via SNI data (CVE-2021-38165)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:57:37Z","modified":"2026-10-29T11:01:06.574194559Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2736-1","title":"lynx - security update","status":"published","published":"2021-08-09T00:00:00Z","modified":"2026-03-09T01:23:21.541069Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4953-1","title":"lynx - security update","status":"published","published":"2021-08-10T00:00:00Z","modified":"2026-03-09T02:09:05.807845Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0422","title":"Updated lynx packages fix security vulnerability","description":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which\nallows remote attackers to discover cleartext credentials because they\nmay appear in SNI data. (CVE-2021-38165)\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:44:45.106916465Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-4800-1","title":"lynx vulnerabilities","description":"It was discovered that Lynx incorrectly handled certain URLs. A remote attacker\ncould possibly use this issue to obtain sensitive information or other\nunspecified impact. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2016-9179)\n\nIt was discovered that Lynx incorrectly handled certain HTML files. A remote\nattacker could possibly use this issue to obtain sensitive information.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000211)\n\nThorsten Glaser discovered that Lynx mishandles the userinfo subcomponents of\na URI. An attacker monitoring the network could discover cleartext\ncredentials because they may appear in SNI data. (CVE-2021-38165)","status":"published","published":"2021-03-15T21:24:24Z","modified":"2026-06-25T13:30:26.449950133Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}