Description
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lynx | 2.9.0dev.6-3 | — |
| Debian 13 | lynx | 2.9.0dev.6-3 | — |
| Debian 12 | lynx | 2.9.0dev.6-3 | — |
| Debian 10 | lynx | 2.8.9rel.1-3+deb10u1 | DSA-4953-1 |
| Debian 9 | lynx | 2.8.9dev11-1+deb9u1 | DLA-2736-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | lynx | 2.9.0dev.5-1ubuntu0.1~esm1 | USN-4800-1 |
| Ubuntu Pro 18.04 LTS | lynx | 2.8.9dev16-3ubuntu0.1~esm1 | USN-4800-1 |
| Ubuntu Pro 16.04 LTS | lynx | 2.8.9dev8-4ubuntu1+esm2 | USN-4800-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | lynx | 2.8.9-4.el8 | RHSA-2022:2129 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | lynx | 2.8.9-4.el8 | ALSA-2022:2129 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | lynx | 2.8.9-4.el8 | RLSA-2022:2129 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.23 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.22 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.21 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.20 | lynx | 2.8.9_p1-r3 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.18 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.17 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.16 | lynx | 2.8.9_p1-r3 | — |
| Alpine v3.15 | lynx | 2.8.9_p1-r3 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lynx | 2.8.9-13.amzn2023.0.3 | ALAS2023-2024-535 |
| Amazon Linux 2 | lynx | 2.8.9-4.amzn2 | ALAS2-2023-2145 |
Advisories 9
- ALSA-2022:2129 Moderate: lynx security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:2129 Red Hat Security Advisory: lynx security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2023-1822 Lynx: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 28, 2026
- RLSA-2022:2129 Moderate: lynx security update Rocky Linux Security Advisories · Jun 28, 2026
- USN-4800-1 lynx vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4953-1 lynx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2736-1 lynx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ALAS2023-2024-535 Moderate: lynx security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 19, 2024
- ALAS2-2023-2145 Moderate: lynx security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 19, 2023
References
- https://bugs.debian.org/991971
- https://www.openwall.com/lists/oss-security/2021/08/07/1
- https://lynx.invisible-island.net/current/CHANGES.html
- https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118
- [oss-security] 20210807 Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) mailing-list
- https://www.openwall.com/lists/oss-security/2021/08/07/11
- [oss-security] 20210807 Re: Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) mailing-list
- [oss-security] 20210807 Re: Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) mailing-list
- [debian-lts-announce] 20210809 [SECURITY] [DLA 2736-1] lynx security update mailing-list
- DSA-4953 vendor-advisory
- FEDORA-2021-f59bda7d94 vendor-advisory
- FEDORA-2021-232161e4d5 vendor-advisory
- FEDORA-2021-57287bd052 vendor-advisory