CVE-2007-5034: ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of th

Q: How do I fix CVE-2007-5034?

elinks: upgrade to newer than 0.11.2. Exact commands for each OS are on this page.

Q: Is CVE-2007-5034 being exploited?

CVE-2007-5034 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2007-5034 affect?

CVE-2007-5034 affects elinks. Severity is medium (CVSS 4.3). ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been pro

Q: How urgent is CVE-2007-5034?

Priority 36/100. No elevated risk signals yet.

Routine

MEDIUM 4.3UPGRADE

CVE-2007-5034 is a medium-severity flaw (CVSS 4.3) affecting elinks. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	4.3 (Medium)
EPSS exploit chance	2.6% (top 15%)
CISA exploited list	No
Weakness	CWE-200
Published	2007-09-21
Last modified	2026-06-16

Publisher (CNA): Canonical Ltd. · Vendor: elinks

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2007-09-21 20:17 UTCPublished CVE record published
2026-06-16 22:45 UTCUpdated Record last modified

elinks elinks UPGRADE

Affected: <= 0.11.1 · <= 0.11.2

Fixed in: newer than 0.11.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy elinks || rpm -q elinks || elinks --version

2. UPGRADE to newer than 0.11.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade elinks

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade elinks

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-5034?

elinks: upgrade to newer than 0.11.2. Exact commands for each OS are on this page.

Is CVE-2007-5034 being exploited?

CVE-2007-5034 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-5034 affect?

CVE-2007-5034 affects elinks. Severity is medium (CVSS 4.3). ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been pro

How urgent is CVE-2007-5034?

Priority 36/100. No elevated risk signals yet.

Related CVEs

CVE-2012-6709 MEDIUM 5.9 DOWNGRADE DOWNGRADE ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.
CVE-2012-4545 MEDIUM 5.1 DOWNGRADE The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, w
CVE-2008-7224 HIGH 7.8 UPGRADE Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of servic
CVE-2007-2027 MEDIUM 4.4 DOWNGRADE Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for El
CVE-2006-5925 HIGH 7.5 DOWNGRADE DOWNGRADE Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbit

References

← Back to latest CVEs