CVE-2020-26154: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Libproxy Project Libproxy: up to and including 0.4.15
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-09-30. Last modified 2026-06-17.