Skip to content
Fencer Vulns
high 7.3

CVE-2024-24806 json

Improper Domain Lookup that potentially leads to SSRF attacks in libuv

published 2024-02-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-22182

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

  • libuv libuv 1.48.0
  • libuv1 Debian 12 1.44.2-1+deb12u1
  • libuv1 Debian 14, Debian 13 1.48.0-1

debian advisories DEBIAN-CVE-2024-24806

  • libuv1 Ubuntu 20.04 LTS 1.34.2-1ubuntu1.5
  • libuv1 Ubuntu 22.04 LTS 1.43.0-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2024-24806

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libuv RHEL 9 1:1.42.0-2.el9_4
  • libuv RHEL 8 1:1.41.1-2.el8_10
  • libuv RHEL 8.8 EUS 1:1.41.1-1.el8_8.1

red hat advisories RHSA-2024:8132RHSA-2024:4756RHSA-2024:4247

  • libuv SLE Module for Basesystem 15 SP6, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +2 more 1.44.2-150500.3.5.1
  • nodejs18 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Web and Scripting 15 SP5 +4 more 18.20.1-150400.9.21.3
  • nodejs18 SLE Module for Web and Scripting 12 18.20.1-8.21.1
  • nodejs20 SLE Module for Web and Scripting 15 SP5, openSUSE Leap 15.5 20.12.1-150500.11.9.2
  • nodejs12 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 12.22.12-150200.4.56.1
  • nodejs14 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 14.21.3-150200.15.55.1
  • nodejs16 SLE Module for Web and Scripting 12 16.20.2-8.39.1
  • nodejs18 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Web and Scripting 15 SP5 +4 more 18.19.1-150400.9.18.2

suse advisories SUSE-SU-2024:4109-1SUSE-SU-2024:1309-1SUSE-SU-2024:1307-1SUSE-SU-2024:1301-1SUSE-SU-2024:0733-1SUSE-SU-2024:0732-1

  • nodejs20 openSUSE Tumbleweed 20.11.1-1.1
  • libuv openSUSE Tumbleweed 1.48.0-1.1

opensuse advisories openSUSE-SU-2024:13697-1openSUSE-SU-2024:13818-1

  • libuv AlmaLinux 9 1:1.42.0-2.el9_4
  • libuv AlmaLinux 8 1:1.41.1-2.el8_10

almalinux advisories ALSA-2024:4756ALSA-2024:4247

  • libuv Rocky Linux 9 1:1.42.0-2.el9_4
  • libuv Rocky Linux 8 1:1.41.1-2.el8_10

rocky linux advisories RLSA-2024:4756RLSA-2024:4247

  • libuv Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.48.0-r0

alpine advisories ALPINE-CVE-2024-24806

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs18 CBL-Mariner 2.0 18.18.2-4
  • libuv CBL-Mariner 2.0 1.43.0-2
  • libuv Azure Linux 3.0 1.48.0-1
  • nodejs Azure Linux 3.0 20.14.0-1
  • python-gevent Azure Linux 3.0 23.9.1-3
  • cmake Azure Linux 3.0 3.28.2-6

azure linux advisories AZL-34278AZL-34306AZL-34957AZL-35051AZL-35133AZL-35782

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-24806 updated cvss 7.3

libuv: Improper Domain Lookup that potentially leads to SSRF attacks

  • Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder EUS (v.8.8) libuv-devel 1.41.1-1.el8_8.1, libuv-debuginfo 1.41.1-1.el8_8.1, libuv-debugsource 1.41.1-1.el8_8.1
    fixed: vendor fix RHSA-2024:8132
  • Red Hat Enterprise Linux AppStream (v. 8) libuv 1.41.1-2.el8_10
    fixed: vendor fix RHSA-2024:4247
  • Red Hat Enterprise Linux AppStream (v. 9) libuv 1.42.0-2.el9_4
    fixed: vendor fix RHSA-2024:4756
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) libuv 1.41.1-1.el8_8.1
    fixed: vendor fix RHSA-2024:8132
  • Red Hat Enterprise Linux CRB (v. 8) libuv-devel 1.41.1-2.el8_10, libuv-debuginfo 1.41.1-2.el8_10, libuv-debugsource 1.41.1-2.el8_10
    fixed: vendor fix RHSA-2024:4247
  • Red Hat Enterprise Linux CRB (v. 9) libuv-devel 1.42.0-2.el9_4, libuv-debuginfo 1.42.0-2.el9_4, libuv-debugsource 1.42.0-2.el9_4
    fixed: vendor fix RHSA-2024:4756

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.00% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

  • libuv libuv

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.