Description
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lynx | 2.8.5-2sarge1.2 | — |
| Debian 13 | lynx | 2.8.5-2sarge1.2 | — |
| Debian 12 | lynx | 2.8.5-2sarge1.2 | — |
| Debian 3.1 | lynx | 2.8.5-2sarge2 | DSA-1076-1 |
| Debian 3.0 | lynx | 2.8.4.1b-3.4 | DSA-1076-1 |
| Debian 3.0 | lynx-ssl | 1:2.8.4.1b-3.3 | DSA-1077-1 |
Advisories 2
- DSA-1077-1 lynx-ssl - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1076-1 lynx - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 11443 vdb-entry
- 20041018 Web browsers - a mini-farce mailing-list
- DSA-1077 vendor-advisory
- 1011809 vdb-entry
- 20060602 Re: [SECURITY] [DSA 1085-1] New lynx-cur packages fix several vulnerabilities mailing-list
- DSA-1076 vendor-advisory
- DSA-1085 vendor-advisory
- 20041018 Web browsers - a mini-farce mailing-list
- http://lcamtuf.coredump.cx/mangleme/gallery/
- 20383 third-party-advisory
- lynx-dos(17804) vdb-entry