Fix CVE-2024-24806
authorDebian Javascript Maintainers <pkg-javascript-devel@alioth-lists.debian.net>
Mon, 6 Apr 2026 14:18:52 +0000 (16:18 +0200)
committerBastien Roucariès <rouca@debian.org>
Mon, 6 Apr 2026 14:18:52 +0000 (16:18 +0200)
commit44613686d1c36873fda02bc93ae7c76b9fe0ffb2
treeb7b0e79e70fd76db7eadfd6a867238ce4f25e419
parent27d4f5b9614075e174f05bf7a428d39becbfa222
Fix CVE-2024-24806

Bug: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6
Bug-Debian: https://bugs.debian.org/1063484
Origin: https://github.com/libuv/libuv
 git diff v1.48.0~5..v1.48.0~2

From upstream change log:
   Merge pull request from GHSA-f74f-cvh7-c6q6
    * fix: always zero-terminate idna output
    * fix: reject zero-length idna inputs
    * test: empty strings are not valid IDNA

See also https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6
===================================================================

Gbp-Pq: Topic libuv
Gbp-Pq: Name fix-cve-2024-24806
deps/uv/src/idna.c