### Summary A security vulnerability identified as CVE-2024-24806 was discovered and fixed in libuv. However, related files aren't fixed in the CMake project. ### Fix Details The vulnerability was fixed in libuv in the following commit/version: - **Project**: libuv https://github.com/libuv/libuv - **Commit1/Commit2/Version**: 0f2d7e7, 3530bcc, v1.48.0 ### Similar Bug in CMake The identical `uv__idna_toascii` function where the fix is applied (src/idna.c file) is used in the CMake project as well (Utilities/cmlibuv/src/idna.c), but the fix is not applied there. ### References - Links to CVE details 1. https://nvd.nist.gov/vuln/detail/CVE-2024-24806 2. https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 - Links to the fix in libuv 1. https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 2. https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 ### Report Origin The bug is reported by a tool developed at [CAST](https://castech.am/).