Skip to main content

GNU libidn CVE-2026-57053

| EUVDEUVD-2026-38523 LOW
Improper Validation of Specified Quantity in Input (CWE-1284)
2026-06-23 mitre GHSA-xpv7-vm32-p7wv
Buffer Overflow Libidn Gnu
2.5
CVSS 3.1 · NVD

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
2.5 LOW
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable via any application processing untrusted domain names; uninitialized memory reads warrant C:L; no integrity impact from read-only access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.0 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 29, 2026 - 19:52 NVD
MEDIUM LOW
CVSS changed
Jun 29, 2026 - 19:52 NVD
4.0 (MEDIUM) 2.5 (LOW)
Patch available
Jun 23, 2026 - 19:02 EUVD
Analysis Generated
Jun 23, 2026 - 17:51 vuln.today

DescriptionNVD

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

AnalysisAI

Out-of-bounds reads of uninitialized memory in GNU libidn before version 1.44 are triggerable through the ToUnicode IDNA APIs when malformed internationalized domain name input is processed by the vulnerable function idna_to_unicode_internal. Applications statically or dynamically linked against affected libidn versions that pass attacker-influenced hostname strings to these APIs are exposed to integrity and availability disruption. No public exploit has been identified at time of analysis, and the successor library libidn2 is explicitly confirmed unaffected, providing a viable migration path for defenders.

Technical ContextAI

GNU libidn implements the Internationalized Domain Names in Applications (IDNA) standard (RFC 3490), providing APIs to convert between ACE (ASCII-Compatible Encoding) Punycode labels and Unicode representations. The idna_to_unicode_internal function is central to the ToUnicode conversion path and is the locus of the flaw. CWE-1284 (Improper Validation of Specified Quantity in Input) identifies the root cause: the function fails to properly bound-check or initialize memory regions associated with input quantities before reading from them, resulting in reads from uninitialized memory beyond allocated buffers. The affected CPE is cpe:2.3:a:gnu:libidn:*:*:*:*:*:*:*:*, covering all libidn releases prior to 1.44. The codebase for libidn2 - the IDNA2008/IDNA2003-compat successor - was written independently and does not contain the vulnerable logic path.

RemediationAI

The primary remediation is upgrading GNU libidn to version 1.44 or later, which addresses the mishandling in idna_to_unicode_internal; upgrade guidance is available through the GNU help-libidn mailing list at https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html. For environments where an immediate upgrade is not feasible, migrating to libidn2 is a viable alternative since the CVE explicitly confirms libidn2 is unaffected - however, note that libidn2 implements IDNA2008 semantics versus libidn's IDNA2003, so API and behavioral compatibility must be validated before switching to avoid application regressions. As an additional compensating control, applications that call the ToUnicode API should validate and sanitize internationalized domain name inputs before passing them to libidn, specifically rejecting malformed or excessively long ACE labels, which reduces the attack surface without requiring an immediate library upgrade.

More in Libidn

View all
CVE-2016-6262 HIGH
7.5 Sep 07

idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as

CVE-2015-8948 HIGH
7.5 Sep 07

idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte
CVE-2016-6261 HIGH
7.5 Sep 07

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial o
CVE-2016-6263 HIGH
7.5 Sep 07

The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to ca
CVE-2015-2059 HIGH
7.5 Aug 12

The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to re

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all
CVE-2025-9316 MEDIUM POC
6.9
CVE-2026-49777 CRITICAL POC
10.0
CVE-2022-37134 CRITICAL POC
9.8
CVE-2021-43267 CRITICAL POC
9.8
CVE-2025-65548 CRITICAL POC
9.1
CVE-2023-54337 CRITICAL POC
9.1
CVE-2025-5349 HIGH POC
8.8
CVE-2026-82750 HIGH POC
8.3

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

Share

CVE-2026-57053 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy