Description
libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libuv | libuv | >= 1.45.0, < 1.48.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libuv1 | 1.48.0-1 | — |
| Debian 13 | libuv1 | 1.48.0-1 | — |
| Debian 12 | libuv1 | 1.44.2-1+deb12u1 | DSA-5638-1 |
| Debian 11 | libuv1 | 1.40.0-2+deb11u1 | DSA-5638-1 |
| Debian 10 | libuv1 | 1.24.1-1+deb10u2 | DLA-3752-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | libuv1 | 1.43.0-1ubuntu0.1 | USN-6666-1 |
| Ubuntu 20.04 LTS | libuv1 | 1.34.2-1ubuntu1.5 | USN-6666-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | libuv +1 | 1:1.42.0-2.el9_4 | RHSA-2024:4756 |
| RHEL 8 | libuv +1 | 1:1.41.1-2.el8_10 | RHSA-2024:4247 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 EUS | libuv +1 | 1:1.41.1-1.el8_8.1 | RHSA-2024:8132 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libuv +1 | 1:1.42.0-2.el9_4 | ALSA-2024:4756 |
| AlmaLinux 8 | libuv +1 | 1:1.41.1-2.el8_10 | ALSA-2024:4247 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | libuv | 1:1.42.0-2.el9_4 | RLSA-2024:4756 |
| Rocky Linux 8 | libuv | 1:1.41.1-2.el8_10 | RLSA-2024:4247 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | libuv | 1.44.2-150500.3.5.1 | SUSE-SU-2024:4109-1 |
| SLES 15 SP5 | libuv | 1.44.2-150500.3.5.1 | SUSE-SU-2024:4109-1 |
| SLES 15 SP5 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:1309-1, SUSE-SU-2024:0730-1 |
| SLES 15 SP5 | nodejs20 | 20.11.1-150500.11.6.1 | SUSE-SU-2024:1301-1, SUSE-SU-2024:0643-1 |
| SLES 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLES 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:1309-1, SUSE-SU-2024:0730-1 |
| SLES 15 SP3 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES 15 SP3 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLES 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLES 15 SP2 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES 15 SP2 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | nodejs16 | 16.20.2-8.39.1 | SUSE-SU-2024:0731-1 |
| SLES 12 | nodejs18 | 18.19.1-8.18.1 | SUSE-SU-2024:1307-1, SUSE-SU-2024:0644-1 |
| SLES for SAP 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLES for SAP 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:1309-1, SUSE-SU-2024:0730-1 |
| SLES for SAP 15 SP3 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES for SAP 15 SP3 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLES for SAP 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLES for SAP 15 SP2 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES for SAP 15 SP2 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLE Micro 5.5 | libuv | 1.44.2-150500.3.5.1 | SUSE-SU-2024:4109-1 |
| SLE HPC 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLE HPC 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:1309-1, SUSE-SU-2024:0730-1 |
| SLE HPC 15 SP3 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLE HPC 15 SP3 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLE HPC 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLE HPC 15 SP2 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLE HPC 15 SP2 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SUSE Manager Server 4.3 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SUSE Manager Server 4.3 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:1309-1, SUSE-SU-2024:0730-1 |
| SUSE Enterprise Storage 7.1 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SUSE Enterprise Storage 7.1 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SUSE Enterprise Storage 7.1 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libuv | 1.48.0-1.1 | openSUSE-SU-2024:13818-1 |
| openSUSE Tumbleweed | nodejs20 | 20.11.1-1.1 | openSUSE-SU-2024:13697-1 |
| openSUSE Leap 15.6 | libuv | 1.44.2-150500.3.5.1 | SUSE-SU-2024:4109-1 |
| openSUSE Leap 15.5 | libuv | 1.44.2-150500.3.5.1 | SUSE-SU-2024:4109-1 |
| openSUSE Leap 15.5 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:1309-1, SUSE-SU-2024:0730-1 |
| openSUSE Leap 15.5 | nodejs20 | 20.11.1-150500.11.6.1 | SUSE-SU-2024:1301-1, SUSE-SU-2024:0643-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libuv | 1.48.0-r0 | — |
| Alpine v3.23 | libuv | 1.48.0-r0 | — |
| Alpine v3.22 | libuv | 1.48.0-r0 | — |
| Alpine v3.21 | libuv | 1.48.0-r0 | — |
| Alpine v3.20 | libuv | 1.48.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libuv +2 | 1:1.47.0-1.amzn2023.0.2 | ALAS2023-2024-540 |
| Amazon Linux 2 | libuv +2 | 1:1.39.0-1.amzn2.0.2 | ALAS2-2024-2474 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.28.2-6 | — |
| Azure Linux 3 | libuv | 1.48.0-1 | — |
| Azure Linux 3 | nodejs | 20.14.0-1 | — |
| Azure Linux 3 | python-gevent | 23.9.1-3 | — |
| Azure Linux 2 (CBL-Mariner) | libuv | 1.43.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs18 | 18.18.2-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libuv +1 | 1:1.42.0-2.el9_4 | ELSA-2024-4756 |
| Oracle Linux 8 | libuv +1 | 1:1.41.1-2.el8_10 | ELSA-2024-4247 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | libuv | 1.48.0-r0 | — |
| Wolfi rolling | nodejs-16 | 16.20.2-r4 | — |
| Wolfi rolling | nodejs-18 | 18.19.0-r2 | — |
| Wolfi rolling | nodejs-20 | 20.11.0-r1 | — |
| Wolfi rolling | nodejs-21 | 21.6.1-r1 | — |
Advisories 34
- ALSA-2024:4756 Moderate: libuv security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:4247 Moderate: libuv security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2024-0393 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 28, 2026
- RHSA-2024:8132 Red Hat Security Advisory: libuv security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2024:4756 Red Hat Security Advisory: libuv security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2024:4247 Red Hat Security Advisory: libuv security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- USN-6666-1 libuv1 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5638-1 libuv1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3752-1 libuv1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2024:0730-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1301-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13818-1 libuv-devel-1.48.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0643-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0733-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0728-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0729-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0644-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0732-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4109-1 Security update for libuv SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13697-1 corepack20-20.11.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0731-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:4756 Moderate: libuv security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2024:4247 Moderate: libuv security update Rocky Linux Security Advisories · May 7, 2025
- SUSE-SU-2024:1307-1 Security update for nodejs18 SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2024:1309-1 Security update for nodejs18 SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- ELSA-2024-4756 Moderate: libuv security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 23, 2024
- ELSA-2024-4247 Moderate: libuv security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 2, 2024
- ALAS2023-2024-540 Moderate: libuv security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2024
- WID-SEC-2024-0540 IGEL OS: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Mar 4, 2024
- ALAS2-2024-2474 Moderate: libuv security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 4, 2024
References
- https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6
- https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629
- https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70
- https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488
- https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39
- http://www.openwall.com/lists/oss-security/2024/02/08/2
- http://www.openwall.com/lists/oss-security/2024/02/11/1
- https://lists.debian.org/debian-lts-announce/2024/03/msg00005.html
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://security.netapp.com/advisory/ntap-20240605-0008/
- https://gitlab.kitware.com/cmake/cmake/-/issues/26112