---
id: CVE-2019-18224
title: >-
  idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based
  buffer overflow via a long domain string.
summary: >-
  idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based
  buffer overflow via a long domain string.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
  - CWE-122
vendor: gnu
product: libidn2
affected:
  - libidn2 < 2.1.1
patched:
  - libidn2 2.1.1
published: '2019-10-21'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:49.913'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-18224'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html'
    label: cve@mitre.org
  - url: 'https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420'
    label: cve@mitre.org
  - url: >-
      https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c
    label: cve@mitre.org
  - url: 'https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/
    label: cve@mitre.org
  - url: 'https://seclists.org/bugtraq/2020/Feb/4'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202003-63'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4168-1/'
    label: cve@mitre.org
  - url: 'https://www.debian.org/security/2020/dsa-4613'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2020/Feb/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202003-63'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4168-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4613'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-18224.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-18224'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1764780'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-18224'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-18224'
  - url: 'https://access.redhat.com/errata/RHBA-2019:3621'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.03708
epssPercentile: 0.89513
ingestedAt: '2026-10-14T07:21:04.821Z'
scores:
  nvd: 9.8
  vendor: 5.6
---

## Overview

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

## Affected

- `libidn2 < 2.1.1`

## Remediation

Upgrade past the affected range:

- `libidn2 2.1.1`

## Vendor advisories

- **RHBA-2019:3621** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2019-11-05 · [advisory](https://access.redhat.com/errata/RHBA-2019:3621)