CVE-2004-1617: University Of Kansas Lynx

Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days.

Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.

Affected products

• University Of Kansas Lynx: version 2.7 only; version 2.8 only; version 2.8.1 only; version 2.8.2_rel1 only; version 2.8.3 only; version 2.8.3_dev22 only; …

Published 2004-10-18. Last modified 2026-06-16.