CVE-2019-12290: gnu libidn2 Improper Input Validation
Vulnerability summary
CVE-2019-12290 is a high (CVSS 7.5) Improper Input Validation vulnerability in gnu libidn2. EPSS estimates a 3.23% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 22-10-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.23%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
+0.24 pp
From 2.99% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- libidn2< 2.0.4-1.1ubuntu0.2
- libidn2-0All versions (No fix recorded)
Alpine1 product
- libidn2< 2.2.0-r0
Chainguard1 product
- libidn2All versions (No fix recorded)
Debian1 product
- libidn2< 2.2.0-1
Gnu1 product
- libidn2< 2.2.0
Wolfi1 product
- libidn2All versions (No fix recorded)
6 vendors · 7 products
References
18 links- gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5X Refsource MISCPatchThird Party AdvisoryREPORTFIX
- gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389deX Refsource CONFIRMThird Party AdvisoryREPORTAdvisory
- lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.htmlVendor AdvisoryX Refsource SUSEWEB
