debian/axel vulnerabilities

Latest debian/axel CVEs

Newest publication first

1. CVE-2026-118485 Axel Download Accelerator Path Traversal via URL Filename Decoding

   Published 2026-10-28

   High·CVSS 7.0 EPSS 0.56%

   Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These seq...

2. CVE-2020-13614 An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.

   Published 2020-05-26

   Medium·CVSS 5.9 EPSS 2.0%

   An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.

3. DSA-706-1 axel - buffer overflow

   Published 2005-04-13

   Unknown

4. CVE-2005-0390 Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.

   Published 2005-04-12

   High·CVSS 7.5 EPSS 3.4%

   Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.