Description
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | elinks | 0.11.1-1.5 | — |
| Debian 13 | elinks | 0.11.1-1.5 | — |
| Debian 12 | elinks | 0.11.1-1.5 | — |
| Debian 4.0 | elinks | 0.11.1-1.2etch1 | DSA-1380-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | elinks | 0.11.1-5.1.0.1.el5 | RHSA-2007:0933 |
| RHEL 4 | elinks | 0.9.2-3.3.5.2 | RHSA-2007:0933 |
Advisories 2
- RHSA-2007:0933 Red Hat Security Advisory: elinks security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1380-1 elinks - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- 26956 third-party-advisory
- oval:org.mitre.oval:def:10335 vdb-entry signature
- http://bugzilla.elinks.cz/show_bug.cgi?id=937
- 27062 third-party-advisory
- FEDORA-2007-2224 vendor-advisory
- 27125 third-party-advisory
- DSA-1380 vendor-advisory
- 26936 third-party-advisory
- RHSA-2007:0933 vendor-advisory
- 20071005 rPSA-2007-0209-1 elinks mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=297981
- 1018764 vdb-entry
- https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018
- FEDORA-2007-710 vendor-advisory
- 25799 vdb-entry
- USN-519-1 vendor-advisory
- ADV-2007-3278 vdb-entry
- 27132 third-party-advisory
- 26949 third-party-advisory
- 27038 third-party-advisory