CVE catalog

CVE-2026-57053

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

[CVE catalog]

Severity: Medium · CVSS 4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: Jun 23, 2026, 4:40:22 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.14% · Oct 25, 2026

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libidn	sid	`1.44-1`	fixed
Debian	libidn	forky	`1.44-1`	fixed
Debian	libidn	trixie	`1.43-1`	vulnerable
Debian	libidn	bookworm	`1.41-1`	vulnerable
Cpe	libidn	Not reported	`1.42-1ubuntu0.1`	fixed
Cpe	idn	Not reported	`1.42-1ubuntu0.1`	fixed
Cpe	libidn-dev	Not reported	`1.42-1ubuntu0.1`	fixed
Cpe	libidn11-dev	Not reported	`1.42-1ubuntu0.1`	fixed
Cpe	libidn12	Not reported	`1.42-1ubuntu0.1`	fixed
Cpe	libidn	Not reported	Not reported	vulnerable
Cpe	libidn	Not reported	`1.44`	fixed
Suse	libidn	linux enterprise server 16.0	`1.43-160000.3.1`	fixed
Suse	libidn	linux enterprise server for sap applications 16.0	`1.43-160000.3.1`	fixed
Suse	libidn	linux enterprise server ltss extended security 12 sp5	`1.28-5.9.1`	fixed
Suse	libidn	linux enterprise module for basesystem 15 sp7	`1.34-150000.3.5.1`	fixed
Opensuse	libidn	leap 16.0	`1.43-160000.3.1`	fixed
Ubuntu	libidn	22.04	`1.33-3`	vulnerable
Ubuntu	libidn	22.04	`1.33-3build1`	vulnerable
Ubuntu	libidn	22.04	`1.38-4`	vulnerable
Ubuntu	libidn	22.04	`1.38-4build1`	vulnerable
Ubuntu	libidn	22.04	`1.38-4ubuntu1`	vulnerable
Ubuntu	libidn	22.04	`1.38-4ubuntu1.1`	fixed
Ubuntu	libidn	24.04	`1.41-1`	vulnerable
Ubuntu	libidn	24.04	`1.42-1`	vulnerable
Ubuntu	libidn	24.04	`1.42-1build1`	vulnerable
Ubuntu	libidn	24.04	`1.42-1ubuntu0.1`	fixed
Ubuntu	libidn	26.04	`1.43-2`	vulnerable
Ubuntu	libidn	26.04	`1.43-2build1`	vulnerable
Ubuntu	libidn	26.04	`1.43-2ubuntu0.26.04.1`	fixed
Ubuntu	libidn	14.04	`1.28-1ubuntu1`	vulnerable
Ubuntu	libidn	14.04	`1.28-1ubuntu2`	vulnerable
Ubuntu	libidn	14.04	`1.28-1ubuntu2.1`	vulnerable
Ubuntu	libidn	14.04	`1.28-1ubuntu2.2`	vulnerable
Ubuntu	libidn	16.04	`1.28-1ubuntu2`	vulnerable
Ubuntu	libidn	16.04	`1.32-3ubuntu1`	vulnerable
Ubuntu	libidn	16.04	`1.32-3ubuntu1.1`	vulnerable
Ubuntu	libidn	16.04	`1.32-3ubuntu1.2`	vulnerable
Ubuntu	libidn	18.04	`1.33-2`	vulnerable
Ubuntu	libidn	18.04	`1.33-2.1`	vulnerable
Ubuntu	libidn	18.04	`1.33-2.1ubuntu1`	vulnerable
Ubuntu	libidn	18.04	`1.33-2.1ubuntu1.1`	vulnerable
Ubuntu	libidn	18.04	`1.33-2.1ubuntu1.2`	vulnerable
Ubuntu	libidn	20.04	`1.33-2.2ubuntu2`	vulnerable
Ubuntu	libidn	22.04	`1.33-3`	vulnerable
Ubuntu	libidn	22.04	`1.33-3build1`	vulnerable
Ubuntu	libidn	22.04	`1.38-4`	vulnerable
Ubuntu	libidn	22.04	`1.38-4build1`	vulnerable
Ubuntu	libidn	22.04	`1.38-4ubuntu1`	vulnerable
Ubuntu	libidn	22.04	`1.38-4ubuntu1.1`	fixed
Ubuntu	libidn	24.04	`1.41-1`	vulnerable
Ubuntu	libidn	24.04	`1.42-1`	vulnerable
Ubuntu	libidn	24.04	`1.42-1build1`	vulnerable
Ubuntu	libidn	24.04	`1.42-1ubuntu0.1`	fixed
Ubuntu	libidn	25.10	`1.43-1`	vulnerable
Ubuntu	libidn	25.10	`1.43-2`	vulnerable
Ubuntu	libidn	26.04	`1.43-2`	vulnerable
Ubuntu	libidn	26.04	`1.43-2build1`	vulnerable
Ubuntu	libidn	26.04	`1.43-2ubuntu0.26.04.1`	fixed
Cpe	libidn	Not reported	`1.44`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libidn	source	sid	`1.44-1`	not yet assigned	Not reported	Not reported
Debian	libidn	source	forky	`1.44-1`	not yet assigned	Not reported	Not reported
Debian	libidn	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libidn	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	libidn	cpe	Not reported	`1.42-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	idn	cpe	Not reported	`1.42-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libidn-dev	cpe	Not reported	`1.42-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libidn11-dev	cpe	Not reported	`1.42-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libidn12	cpe	Not reported	`1.42-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libidn	cpe	Not reported	`1.44`	Not reported	Not reported	Not reported
Suse	libidn	rpm	linux enterprise server 16.0	`1.43-160000.3.1`	Not reported	SUSE-SU-2026:23621-1	Not reported
Suse	libidn	rpm	linux enterprise server for sap applications 16.0	`1.43-160000.3.1`	Not reported	SUSE-SU-2026:23621-1	Not reported
Suse	libidn	rpm	linux enterprise server ltss extended security 12 sp5	`1.28-5.9.1`	Not reported	SUSE-SU-2026:4081-1	Not reported
Suse	libidn	rpm	linux enterprise module for basesystem 15 sp7	`1.34-150000.3.5.1`	Not reported	SUSE-SU-2026:4000-1	Not reported
Opensuse	libidn	rpm	leap 16.0	`1.43-160000.3.1`	Not reported	OPENSUSE-SU-2026:21758-1	Not reported
Ubuntu	libidn	deb	22.04	`1.38-4ubuntu1.1`	Not reported	USN-8521-1	Not reported
Ubuntu	libidn	deb	24.04	`1.42-1ubuntu0.1`	Not reported	USN-8521-1	Not reported
Ubuntu	libidn	deb	26.04	`1.43-2ubuntu0.26.04.1`	Not reported	USN-8521-1	Not reported
Ubuntu	libidn	deb	22.04	`1.38-4ubuntu1.1`	Not reported	UBUNTU-CVE-2026-57053	Not reported
Ubuntu	libidn	deb	24.04	`1.42-1ubuntu0.1`	Not reported	UBUNTU-CVE-2026-57053	Not reported
Ubuntu	libidn	deb	26.04	`1.43-2ubuntu0.26.04.1`	Not reported	UBUNTU-CVE-2026-57053	Not reported
Cpe	libidn	cpe	Not reported	`1.44`	Not reported	NVD-CVE-2026-57053	Not reported

Notes

[trixie] libidn: Minor issue [bookworm] libidn: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[idn]Affected
Source package: [libidn]
Details (2)
- 1.41-1 · amd64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
- 1.41-1 · arm64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
[libidn11-dev]Affected
Source package: [libidn]
Details (2)
- 1.41-1 · amd64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
- 1.41-1 · arm64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
[libidn12]Affected
Source package: [libidn]
Details (2)
- 1.41-1 · amd64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
- 1.41-1 · arm64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
[libidn-dev]Affected
Source package: [libidn]
Details (2)
- 1.41-1 · amd64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12
- 1.41-1 · arm64 · bookworm
  Affected
  nvd · libidn · debian · bookworm; nvd · libidn · debian · 12

[Debian 13 (Trixie)]

[idn]Affected
Source package: [libidn]
Details (2)
- 1.43-1 · amd64 · trixie
  Affected
  nvd · libidn · debian · 13
- 1.43-1 · arm64 · trixie
  Affected
  nvd · libidn · debian · 13
[libidn12]Affected
Source package: [libidn]
Details (2)
- 1.43-1 · amd64 · trixie
  Affected
  nvd · libidn · debian · 13
- 1.43-1 · arm64 · trixie
  Affected
  nvd · libidn · debian · 13
[libidn-dev]Affected
Source package: [libidn]
Details (2)
- 1.43-1 · amd64 · trixie
  Affected
  nvd · libidn · debian · 13
- 1.43-1 · arm64 · trixie
  Affected
  nvd · libidn · debian · 13

Observed: Oct 26, 2026, 2:09:35 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]