debian/libuv1 vulnerabilities

Latest debian/libuv1 CVEs

Newest publication first

1. DSA-5638-1 libuv1 - security update

   Published 2024-03-10

   Unknown

2. DLA-3752-1 libuv1 - security update

   Published 2024-03-05

   Unknown

3. CVE-2024-24806 Improper Domain Lookup that potentially leads to SSRF attacks in libuv

   Published 2024-02-07

   High·CVSS 7.3 EPSS 2.0%

   libuv is a multi-platform support library with a focus on asynchronous I/O. The uv_getaddrinfo function in src/unix/getaddrinfo.c (and its windows counterpart src/win/getaddrinfo.c), truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited...

4. CVE-2021-22918 Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether...

   Published 2021-07-12

   Medium·CVSS 5.3 EPSS 23.1%

   Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th...

5. DSA-4936-1 libuv1 - security update

   Published 2021-07-05

   Unknown

6. CVE-2020-8252 The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is long...

   Published 2020-09-18

   High·CVSS 7.8 EPSS 0.71%

   The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.