CVE-2026-57053

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-1284

Description

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Affected products

GNU libidn: from 0.1.15 before 1.44 — fixed in 1.44

How to fix

Upgrade to a fixed version: GNU libidn 1.44. Check the vendor advisory for mitigations.

References

https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html
https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html

Get alerted when CVE-2026-57053 or the next vulnerability affects your stack