← Back

CVE-2026-43861

nvd nist
Published: May 4, 2026Modified: Jun 17, 2026Deferred

JSON object

Loading...
3.7
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.2 / Impact: 1.4
Source: MITRE (Secondary)

Description

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

Related CWEs

CWE-158
Improper Neutralization of Null Byte or NUL Character
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

References (1)

Source: cve@mitre.org

Timeline

No history available yet.