CVE-2024-24806 Improper Domain Lookup that potentially leads to SSRF attacks in libuv

🗓️ 07 Feb 2024 21:44:33Reported by GoogleType

osv🔗 osv.dev👁 45 Views

libuv `uv_getaddrinfo` function truncates hostnames to 256 characters before calling `getaddrinfo`, allowing for address exploitation and bypassing developer checks. Vulnerability addressed in release version 1.48.0. Users advised to upgrade. No known workarounds.

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/02/08/2
openwall	www.openwall.com/lists/oss-security/2024/02/11/1
openwall	www.openwall.com/lists/oss-security/2024/03/11/1
lists	www.lists.debian.org/debian-lts-announce/2024/03/msg00005.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24806.json
github	www.github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-24806
security	www.security.netapp.com/advisory/ntap-20240605-0008/
gitlab	www.gitlab.kitware.com/cmake/cmake/-/issues/26112
github	www.github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629

12 Aug 2026 14:52Current

7High risk

Vulners AI Score7

CVSS 3.17.3