Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade lynx | May 20, 2022 | Aug 7, 2021 |
| Alpine Linux | — | Upgrade lynx | Mar 26, 2024 | Aug 7, 2021 |
| Amazon Linux Ami 2 | — | Upgrade lynxUpgrade lynx-debuginfo | Jul 21, 2023 | Aug 7, 2021 |
| Amazon_linux_2023 | — | Upgrade lynxUpgrade lynx-debuginfoUpgrade lynx-debugsource | Feb 17, 2025 | Aug 7, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 7, 2021 |
| Debian | — | Upgrade lynx | Aug 12, 2021 | Aug 7, 2021 |
| Oracle Solaris | — | Upgrade web/browser/lynx to version 2.8.8-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Aug 7, 2021 |
| Redhat_linux | — | No solution existsUpgrade lynx-debugsourceUpgrade lynx-debuginfoUpgrade lynx | Dec 15, 2023 | Aug 7, 2021 |
| Rocky_linux | — | Upgrade lynx-debuginfoUpgrade lynxUpgrade lynx-debugsource | Jun 29, 2026 | Jun 28, 2026 |
| Ubuntu | — | Upgrade lynx (Ubuntu Pro) | Mar 22, 2023 | Aug 7, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub