CVE-2024-24806

CVE-2024-24806 affects libuv, a multi-platform support library, due to improper hostname truncation in the uv_getaddrinfo function. This allows attackers to craft malicious hostnames that resolve to unintended IP addresses, potentially bypassing security checks and leading to Server-Side Request Forgery (SSRF) attacks against internal APIs or user-generated content pages. The vulnerability has a CVSS score of 7.3 (HIGH), indicating a network-based attack with low complexity and potential for low impact on confidentiality, integrity, and availability. There are no known workarounds, and users are advised to upgrade to libuv version 1.48.0 or later. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. It is not listed on the CISA KEV catalog or Hot List.