Server-Side Request Forgery (SSRF)

libuv.so is vulnerable to Server-Side Request Forgery (SSRF). The vulnerability arises due to how the hostname_ascii variable (with a length of 256 bytes) is handled in uv_getaddrinfo and subsequently in uv__idna_toascii. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte allowing an attacker access to internal APIs or websites that allow users to have username.example.com pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.