ZeroDay Findings
Sign inSign up

Findings

CVE-2019-3859

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions.

Published Mar 21, 2019 · updated Oct 14, 2026 · libssh2 libssh2

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 21, 2019 · NIST NVD

    Detected

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

  2. Oct 14, 2026 · NIST NVD

    Updated

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Affected

  • cpe debian/debian linux8.0
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora28
  • cpe fedoraproject/fedora29
  • cpe libssh2/libssh2version unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe opensuse/leap15.0
  • cpe opensuse/leap42.3

Sources

  • CVE.orgVulnerability recordCVE-2019-3859

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-3859

    30-day exploitation probability 6.3%

    first.org
  • NIST NVDVulnerability recordCVE-2019-3859

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2019-3859 · ZeroDay Findings