CVE-2021-38165

5.3 mediumEPSS 3.9%

Medium (5.3). EPSS 3.9% chance of exploitation in the next 30 days.

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2021-08-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
lynx_project:lynx

References

http://www.openwall.com/lists/oss-security/2021/08/07/11
http://www.openwall.com/lists/oss-security/2021/08/07/12
http://www.openwall.com/lists/oss-security/2021/08/07/9
https://bugs.debian.org/991971
https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118

Check your stack JSON