debian/aria2 vulnerabilities

Latest debian/aria2 CVEs

Newest publication first

1. CVE-2026-75421 aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.

   Published 2026-08-25

   Medium·CVSS 4.0 EPSS 0.16%

   aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.

2. CVE-2026-71832 aria2: Aria2: Denial of Service via Divide By Zero vulnerability

   Published 2026-08-24

   Medium·CVSS 6.2 EPSS 0.16%

   Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service

3. CVE-2026-8367 aria2c Improper Certificate Validation

   Published 2026-05-13

   Medium·CVSS 5.3 EPSS 0.13%

   aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

4. DLA-2873-1 aria2 - security update

   Published 2021-12-31

   Unknown

5. DLA-1636-1 aria2 - security update

   Published 2019-01-22

   Unknown

6. CVE-2019-3500 aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

   Published 2019-01-02

   High·CVSS 7.8 EPSS 0.35%

   aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

7. CVE-2010-1512 Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.

   Published 2010-05-17

   Medium·CVSS 4.3 EPSS 3.2%

   Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.

8. DSA-2047-1 aria2 - directory traversal

   Published 2010-05-17

   Unknown

9. DSA-1957-1 aria2 - arbitrary code execution

   Published 2009-12-28

   Unknown

10. CVE-2009-3617 Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or caus...

    Published 2009-10-20

    High·CVSS 7.6 EPSS 4.9%

    Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a down...

11. CVE-2009-3575 Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknow...

    Published 2009-10-07

    High·CVSS 10.0 EPSS 5.8%

    Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.