GCVE - cpe:2.3:a:gnu:libidn2:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:libidn2:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gnu (`575dd98a-a14a-5d9e-a2eb-97d38d86fcb9`)
Product	Libidn2 (`8cf65ba2-46ae-5bb8-ad2f-126a69d6103f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libidn2`	purl2cpe	2026-06-01 10:11:56.356688
`pkg:deb/ubuntu/libidn2`	purl2cpe	2026-06-01 10:11:56.356691
`pkg:github/clearlinux-pkgs/libidn2`	purl2cpe	2026-06-01 10:11:56.356694
`pkg:gnu/libidn`	purl2cpe	2026-06-01 10:11:56.356697
`pkg:rpm/centos/libidn2`	purl2cpe	2026-06-01 10:11:56.356700
`pkg:rpm/fedora/libidn2`	purl2cpe	2026-06-01 10:11:56.356702
`pkg:rpm/opensuse/libidn2`	purl2cpe	2026-06-01 10:11:56.356705

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-18224`	vulnerable	2026-06-08 05:13:11.057225	Details available idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string. Published: 2019-10-21T16:21:46.000Z Updated: 2024-08-05T01:47:14.080Z Open on db.gcve.eu Reference links https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1 https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 https://usn.ubuntu.com/4168-1/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-12290`	vulnerable	2026-06-08 05:12:38.891664	Details available GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated. Published: 2019-10-22T15:14:06.000Z Updated: 2024-08-04T23:17:39.504Z Open on db.gcve.eu Reference links https://gitlab.com/libidn/libidn2/merge_requests/71 https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5 https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de https://usn.ubuntu.com/4168-1/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6ZXL2RDNQRAHCMKWPOMJFKYJ344X4HL/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14062`	vulnerable	2026-06-08 05:08:49.166038	Details available Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact. Published: 2017-08-31T16:00:00.000Z Updated: 2024-08-05T19:13:41.830Z Open on db.gcve.eu Reference links http://www.debian.org/security/2017/dsa-3988 https://gitlab.com/libidn/libidn2/blob/master/NEWS https://gitlab.com/libidn/libidn2/commit/3284eb342cd0ed1a18786e3fcdf0cdd7e76676bd https://lists.debian.org/debian-lts-announce/2018/07/msg00040.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14061`	vulnerable	2026-06-08 05:08:49.165435	Details available Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact. Published: 2017-08-31T16:00:00.000Z Updated: 2024-09-17T00:30:30.682Z Open on db.gcve.eu Reference links https://gitlab.com/libidn/libidn2/commit/16853b6973a1e72fee2b7cccda85472cb9951305 https://gitlab.com/libidn/libidn2/blob/master/NEWS	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.