PT-2025-46008 · Julia · Libcurl Jll
Published
2025-10-10
·
Updated
2025-10-10
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
libcurl's URL API function
[curl url get()](https://curl.se/libcurl/c/curl url get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the macidn IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Libcurl Jll