ZeroDay Findings
Sign inSign up

Findings

CVE-2019-16905

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured…

Published Oct 9, 2019 · updated Oct 14, 2026 · openbsd openssh

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 9, 2019 · NIST NVD

    Detected

    OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and

  2. Oct 14, 2026 · NIST NVD

    Updated

    OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and

Affected

  • cpe netapp/cloud backupversion unspecified
  • cpe netapp/steelstore cloud integrated storageversion unspecified
  • cpe openbsd/opensshversion unspecified
  • cpe siemens/scalance x204rna ecc firmwareversion unspecified
  • cpe siemens/scalance x204rna firmwareversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2019-16905

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-16905

    30-day exploitation probability 2.2%

    first.org
  • NIST NVDVulnerability recordCVE-2019-16905

    OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XM

    nvd.nist.gov

References