CVE-2021-38165: Debian Linux

Medium severity, CVSS 5.3. EPSS: 4.1% chance of exploitation in the next 30 days.

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Lynx Project Lynx: up to and including 2.8.9

Published 2021-08-07. Last modified 2026-06-17.