{"id":"CVE-2024-24806","aliases":["ALPINE-CVE-2024-24806","ALSA-2024:4247","ALSA-2024:4756","AZL-34278","AZL-34306","AZL-34957","AZL-35051","AZL-35133","AZL-35782","BELL-CVE-2024-24806","CLSA-2025-1762363908","DEBIAN-CVE-2024-24806","DLA-3752-1","DSA-5638-1","EUVD-2024-22182","GHSA-f74f-cvh7-c6q6","MGASA-2024-0079","OESA-2024-1200","RHSA-2024:4247","RHSA-2024:4756","RHSA-2024:8132","RLSA-2024:4247","RLSA-2024:4756","ROOT-OS-ALPINE-318-CVE-2024-24806","ROOT-OS-ALPINE-319-CVE-2024-24806","SUSE-SU-2024:0643-1","SUSE-SU-2024:0644-1","SUSE-SU-2024:0728-1","SUSE-SU-2024:0729-1","SUSE-SU-2024:0730-1","SUSE-SU-2024:0731-1","SUSE-SU-2024:0732-1","SUSE-SU-2024:0733-1","SUSE-SU-2024:1301-1","SUSE-SU-2024:1307-1","SUSE-SU-2024:1309-1","SUSE-SU-2024:4109-1","UBUNTU-CVE-2024-24806","USN-6666-1","openSUSE-SU-2024:13697-1","openSUSE-SU-2024:13818-1"],"status":"published","title":"Improper Domain Lookup that potentially leads to SSRF attacks in libuv","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02003,"percentile":0.81077,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-02-07T21:44:33Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libuv","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libuv-devel","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libuv","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libuv-devel","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.18.2-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libuv","fixed_in":["1.43.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libuv","fixed_in":["1.48.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-gevent","fixed_in":["23.9.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.28.2-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nodejs","fixed_in":["18.19.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["20.11.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","fixed_in":["18.19.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libuv","fixed_in":["1.48.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["20.11.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuv","fixed_in":["1:1.42.0-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuv-devel","fixed_in":["1:1.42.0-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuv-static","fixed_in":["1:1.42.0-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libuv1","fixed_in":["1.44.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libuv1","fixed_in":["1.48.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libuv1","fixed_in":["1.48.0-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libuv1","fixed_in":["1.24.1-1+deb10u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libuv1","fixed_in":["1.40.0-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libuv","fixed_in":["1.44.2-2.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libuv","fixed_in":["1.42.0-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libuv","fixed_in":["1.42.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libuv","fixed_in":["1.42.0-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"libuv","fixed_in":["1.42.0-8.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"libuv","fixed_in":["1.42.0-8.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libuv","fixed_in":["1.42.0-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libuv","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libuv-debuginfo","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libuv-debugsource","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libuv-debuginfo","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libuv-debugsource","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libuv-devel","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libuv","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libuv-debuginfo","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libuv-debugsource","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libuv-debuginfo","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libuv-debugsource","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libuv-devel","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libuv","fixed_in":["1:1.41.1-1.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libuv-debuginfo","fixed_in":["1:1.41.1-1.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libuv-debugsource","fixed_in":["1:1.41.1-1.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"libuv-debuginfo","fixed_in":["1:1.41.1-1.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"libuv-debugsource","fixed_in":["1:1.41.1-1.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"libuv-devel","fixed_in":["1:1.41.1-1.el8_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libuv","fixed_in":["1:1.41.1-2.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libuv","fixed_in":["1:1.42.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-libuv","fixed_in":["1.44.2-r20071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-libuv","fixed_in":["1.47.0-r00071"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libuv","fixed_in":["1.44.2-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libuv","fixed_in":["1.44.2-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libuv","fixed_in":["1.44.2-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libuv","fixed_in":["1.44.2-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libuv","fixed_in":["1.44.2-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libuv1","fixed_in":["1.34.2-1ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libuv1","fixed_in":["1.43.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libuv","fixed_in":["1.48.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libuv-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libuv-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-gevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.9.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.2-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.44.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"18.19.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.44.2-r1"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.11.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"18.19.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.44.2-r1"},{"fixed":"1.48.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.11.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuv-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuv-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-1+deb12u1"}]}],"versions":["1.44.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-1+deb10u2"}]}],"versions":["1.24.1-1","1.24.1-1+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2+deb11u1"}]}],"versions":["1.40.0-2"]},{"source":"osv","ecosystem":"Debian:12","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-1+deb12u1"}]}],"versions":["1.44.2-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-2.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-8.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-8.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libuv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libuv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libuv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libuv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libuv-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libuv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libuv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libuv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libuv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libuv-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-1.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libuv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-1.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libuv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-1.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"libuv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-1.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"libuv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-1.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"libuv-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-1.el8_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.41.1-2.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.42.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-r20071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.47.0-r00071"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-8.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.30.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.1-150400.9.18.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-8.39.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.3-150200.15.55.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-150500.11.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.1-150500.11.9.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-8.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.1-150400.9.21.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1ubuntu1.5"}]}],"versions":["1.30.1-1","1.33.1-2","1.33.1-2ubuntu2","1.33.1-3ubuntu1","1.34.2-1ubuntu1","1.34.2-1ubuntu1.1","1.34.2-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1ubuntu0.1"}]}],"versions":["1.40.0-2ubuntu1","1.42.0-1","1.43.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1ubuntu1.5"}]}],"versions":["1.30.1-1","1.33.1-2","1.33.1-2ubuntu2","1.33.1-3ubuntu1","1.34.2-1ubuntu1","1.34.2-1ubuntu1.1","1.34.2-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1ubuntu0.1"}]}],"versions":["1.40.0-2ubuntu1","1.42.0-1","1.43.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48.0-1.1"}]}]}],"products":[{"vendor":"libuv","product":"libuv"}],"references":[{"url":"https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/08/2","tags":["x_transferred","Mailing List","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/11/1","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00005.html","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/11/1","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240605-0008/","tags":["x_transferred","advisory"]},{"url":"https://gitlab.kitware.com/cmake/cmake/-/issues/26112","tags":["x_transferred","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-24806","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4247","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24806","tags":["report"]},{"url":"https://bugzilla.redhat.com/2263292","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-4247.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4756","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-4756.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24806","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-24806","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-18","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762363908.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24806.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-24806","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0079.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32822","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/02/08/2","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00044.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1200","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263292","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4247.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24806","tags":["advisory","report"]},{"url":"https://www.chainguard.dev/unchained/unpacking-libuvs-cve-2024-24806-software-dark-matter-will-go-under-the-radar-not-in-chainguard-images-tho","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4756.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8132","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8132.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4247","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4756","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219152","tags":["report"]},{"url":"https://bugzilla.suse.com/1219724","tags":["report"]},{"url":"https://bugzilla.suse.com/1219992","tags":["report"]},{"url":"https://bugzilla.suse.com/1219993","tags":["report"]},{"url":"https://bugzilla.suse.com/1219994","tags":["report"]},{"url":"https://bugzilla.suse.com/1219995","tags":["report"]},{"url":"https://bugzilla.suse.com/1219997","tags":["report"]},{"url":"https://bugzilla.suse.com/1219998","tags":["report"]},{"url":"https://bugzilla.suse.com/1219999","tags":["report"]},{"url":"https://bugzilla.suse.com/1220014","tags":["report"]},{"url":"https://bugzilla.suse.com/1220017","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240644-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240728-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220053","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240729-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240730-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240731-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240732-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240733-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241301-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222244","tags":["report"]},{"url":"https://bugzilla.suse.com/1222384","tags":["report"]},{"url":"https://bugzilla.suse.com/1222530","tags":["report"]},{"url":"https://bugzilla.suse.com/1222603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-30260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-30261","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241307-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241309-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244109-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-24806","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6666-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24806","title":"Improper Domain Lookup that potentially leads to SSRF attacks in libuv","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T21:44:33.566Z","modified":"2025-06-17T14:17:09.153Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-22182","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T21:44:33Z","modified":"2025-06-17T14:17:09Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:22.732364Z"}],"nvd":[{"id":"CVE-2024-24806","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10.173Z","modified":"2026-06-17T07:14:55.463Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:09:35.738752Z"}],"osv":[{"id":"ALPINE-CVE-2024-24806","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10.173Z","modified":"2026-11-02T11:17:50.077358413Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-34278","title":"CVE-2024-24806 affecting package nodejs18 for versions less than 18.18.2-4","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10Z","modified":"2026-04-21T04:27:05.525967Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34306","title":"CVE-2024-24806 affecting package libuv for versions less than 1.43.0-2","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10Z","modified":"2026-04-21T04:27:05.665087Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34957","title":"CVE-2024-24806 affecting package libuv for versions less than 1.48.0-1","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10Z","modified":"2026-04-21T04:33:05.572601Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35051","title":"CVE-2024-24806 affecting package nodejs for versions less than 20.14.0-1","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10Z","modified":"2026-04-21T04:52:00.689273Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35133","title":"CVE-2024-24806 affecting package python-gevent for versions less than 23.9.1-3","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-35782","title":"CVE-2024-24806 affecting package cmake for versions less than 3.28.2-6","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10Z","modified":"2026-04-21T04:33:13.269128Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2024-24806","status":"published","published":"2024-02-09T05:57:16.861138Z","modified":"2026-09-17T07:15:03.948873153Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-24806","title":"Improper Domain Lookup that potentially leads to SSRF attacks in libuv","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T21:44:33.566Z","modified":"2026-10-28T10:40:27.148703928Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-24806","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:10.173Z","modified":"2026-11-02T12:01:37.472160179Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1200","title":"libuv security update","description":"libuv is a multi-platform support library with a focus on asynchronous I/O.  It was primarily developed for use by Node.js, but it’s also used by Luvit, Julia, pyuv, and others.\r\n\r\nSecurity Fix(es):\r\n\r\nlibuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-24806)","status":"published","published":"2024-02-23T11:06:38Z","modified":"2026-08-18T01:18:16.389747474Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:4247","title":"Red Hat Security Advisory: libuv security update","status":"published","published":"2024-09-16T20:08:19Z","modified":"2026-07-03T10:05:40Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4756","title":"Red Hat Security Advisory: libuv security update","status":"published","published":"2024-09-16T20:08:27Z","modified":"2026-07-03T10:05:52Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:8132","title":"Red Hat Security Advisory: libuv security update","status":"published","published":"2024-10-15T18:19:27Z","modified":"2026-07-03T10:06:21Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:4247","title":"Moderate: libuv security update","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. \n\nSecurity Fix(es):\n\n* libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:46.575488Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:4756","title":"Moderate: libuv security update","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. \n\nSecurity Fix(es):\n\n* libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:13:05.465265Z","modified":"2025-10-07T17:38:13.968551Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-24806","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-02-07T22:15:00Z","modified":"2026-04-22T14:40:37.234335Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:4247","title":"Moderate: libuv security update","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. \n\nSecurity Fix(es):\n\n* libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2026-10-29T11:02:21.331372154Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:4756","title":"Moderate: libuv security update","description":"libuv is a multi-platform support library with a focus on asynchronous I/O. \n\nSecurity Fix(es):\n\n* libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-23T00:00:00Z","modified":"2026-10-29T11:31:47.362457626Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2025-1762363908","title":"libuv: Fix of CVE-2024-24806","description":"- CVE-2024-24806: fix issue where uv_getaddrinfo function truncates hostnames,\n  potentially allowing crafted payloads to resolve to unintended IP addresses,\n  by handling hostname_ascii variable properly in uv_getaddrinfo and\n  uv__idna_toascii functions","status":"published","published":"2025-11-05T17:31:54Z","modified":"2026-06-01T00:31:15.165597583Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3752-1","title":"libuv1 - security update","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-03-09T01:22:08.863155Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5638-1","title":"libuv1 - security update","status":"published","published":"2024-03-10T00:00:00Z","modified":"2026-03-09T02:09:52.437611Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0079","title":"Updated libuv packages fix security vulnerability","description":"It was discovered that the uv_getaddrinfo() function in libuv, an\nasynchronous event notification library, incorrectly truncated certain\nhostnames, which may result in bypass of security measures on internal\nAPIs or SSRF attacks. (CVE-2024-24806)\n","status":"published","published":"2024-03-22T00:19:51Z","modified":"2026-04-16T04:41:15.201840343Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13697-1","title":"corepack20-20.11.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:47.667066Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13818-1","title":"libuv-devel-1.48.0-1.1 on GA media","description":"These are all security issues fixed in the libuv-devel-1.48.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:43.587966Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2024-24806","title":"CVE-2024-24806 in rootio-libuv - Patched by Root","description":"Root has patched CVE-2024-24806 in the rootio-libuv package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2025-08-12T08:23:12Z","modified":"2026-02-13T03:20:11.691676Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2024-24806","title":"CVE-2024-24806 in rootio-libuv - Patched by Root","description":"Root has patched CVE-2024-24806 in the rootio-libuv package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2025-08-12T08:23:12Z","modified":"2026-02-13T03:19:33.260349Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2024:0643-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.11.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j\n* CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).\n* CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\nUpdate to 20.11.0:\n\n* esm: add import.meta.dirname and import.meta.filename\n* fs: add c++ fast path for writeFileSync utf8\n* module: remove useCustomLoadersIfPresent flag\n* module: bootstrap module loaders in shadow realm\n* src: add --disable-warning option\n* src: create per isolate proxy env template\n* src: make process binding data weak\n* stream: use Array for Readable buffer\n* stream: optimize creation\n* test_runner: adds built in lcov reporter\n* test_runner: add Date to the supported mock APIs\n* test_runner, cli: add --test-timeout flag\n\nUpdate to 20.10.0:\n\n* --experimental-default-type flag to flip module defaults\n* The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.\n* Added flush option in file system functions for fs.writeFile functions\n* Added experimental WebSocket client\n* vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script\n","status":"published","published":"2024-02-28T08:43:43Z","modified":"2026-02-04T04:14:35.479433Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0644-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.19.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\n\nUpdate to LTS version 18.19.0\n\n* deps: npm updates to 10.x\n* esm:\n  + Leverage loaders when resolving subsequent loaders\n  + import.meta.resolve unflagged\n  + --experimental-default-type flag to flip module defaults\n","status":"published","published":"2024-02-28T08:43:54Z","modified":"2026-02-04T03:24:05.295121Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0728-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:00:10Z","modified":"2026-02-04T03:52:10.618962Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0729-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:00:23Z","modified":"2026-02-04T03:36:14.46951Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0730-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.19.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\nUpdate to LTS version 18.19.0\n\n* deps: npm updates to 10.x\n* esm:\n  + Leverage loaders when resolving subsequent loaders\n  + import.meta.resolve unflagged\n  + --experimental-default-type flag to flip module defaults\n","status":"published","published":"2024-02-29T12:00:44Z","modified":"2026-02-04T04:26:23.326252Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0731-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:01:07Z","modified":"2026-02-04T02:41:11.113618Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0732-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:01:40Z","modified":"2026-02-04T03:14:27.967346Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0733-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).\n","status":"published","published":"2024-02-29T12:02:13Z","modified":"2026-02-04T04:11:41.134872Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1301-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.12.1\n\nSecurity fixes:\n\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T01:33:32Z","modified":"2026-02-04T04:24:48.480942Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1307-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.1\n\nSecurity fixes:\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T09:32:01Z","modified":"2025-05-02T04:36:31.314523Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1309-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.1\n\nSecurity fixes:\n\n - CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244)\n - CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384)\n - CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530)\n - CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603)  \n - CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053)\n","status":"published","published":"2024-04-16T09:32:58Z","modified":"2025-05-02T04:36:31.375867Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:4109-1","title":"Security update for libuv","description":"This update for libuv fixes the following issues:\n\n- CVE-2024-24806: Fixed improper Domain Lookup that potentially leads to SSRF attacks (bsc#1219724)\n","status":"published","published":"2024-11-28T16:15:44Z","modified":"2026-02-04T03:11:08.257411Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6666-1","title":"libuv1 vulnerability","description":"It was discovered that libuv incorrectly truncated certain hostnames. A\nremote attacker could possibly use this issue with specially crafted\nhostnames to bypass certain checks.\n","status":"published","published":"2024-02-28T13:20:14Z","modified":"2026-04-22T10:45:17.29019Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}