CVE-2024-24806

A server-side request forgery SSRF flaw was found in the libuv package due to how the hostnameascii variable is handled in uvgetaddrinfo and uvidnatoascii. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result, attackers may be able to access...

CVE-2024-24806

libuv is a multi-platform support library with a focus on asynchronous I/O. The "uvgetaddrinfo" function in "src/unix/getaddrinfo.c" and its windows counterpart "src/win/getaddrinfo.c", truncates hostnames to 256 characters before calling "getaddrinfo". This behavior can be exploited to create...