Executive brief
GNU libidn is a library used by applications to handle internationalized domain names. A flaw in how it processes certain web addresses could allow an attacker to bypass security filters, such as allowlists or blocklists, by causing the library to incorrectly normalize a domain name. This could lead to unauthorized access or the misrouting of data in applications that rely on libidn for security decisions.
Technical details
A vulnerability exists in GNU libidn's idna_to_unicode_internal function due to an incorrect assumption during round-trip verification. When processing an ACE (ASCII Compatible Encoding) label, the code assumes the ToASCII result will always contain the 'xn--' prefix. If the decoded label is actually a short ASCII string, the code performs a comparison starting at an offset that points into uninitialized stack memory. An attacker can exploit this by providing specially crafted domain strings that, depending on stale stack content, may be incorrectly normalized (e.g., 'xn--com-' becoming 'com'). This can bypass security checks in applications that use libidn to normalize domains for access control or routing. The issue is fixed in version 1.44.
Affected products
- GNU libidn 0.1.15 to 1.43
Timeline
- 2026-05-19: disclosed: Reported to maintainers by DMSAN
- 2026-06-16: patched: Version 1.44 released with fix
- 2026-06-16: advisory: Project advisory published by Simon Josefsson
- 2026-06-23: advisory: CVE-2026-57053 published