CVE-2024-51317: 
Linux Debian vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2024-51317) was discovered in NetSurf browser version 3.11, specifically in the domnodenormalize function. The vulnerability was disclosed on November 3, 2025, and affects multiple versions of the NetSurf browser package (Ubuntu Security, Debian Security).

The vulnerability has been assigned a CVSS 3.1 base score of 6.5 (Medium), with the following characteristics: Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, Low confidentiality impact, Low integrity impact, and No availability impact. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (Ubuntu Security).

The vulnerability could potentially allow remote attackers to execute arbitrary code through the domnodenormalize function. The impact assessment indicates low confidentiality and integrity impacts, with no direct impact on system availability (Ubuntu Security).

The vulnerability affects multiple versions of NetSurf, including versions in Debian bookworm, bullseye (3.10-1), and forky, sid, trixie (3.11-2). As of the latest reports, the vulnerability remains unfixed in these versions (Debian Security).