ZeroDay Findings
Sign inSign up

Findings

CVE-2019-3861

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed.

Published Mar 25, 2019 · updated Oct 14, 2026 · libssh2 libssh2

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 25, 2019 · NIST NVD

    Detected

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

  2. Oct 14, 2026 · NIST NVD

    Updated

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Affected

  • cpe debian/debian linux8.0
  • cpe libssh2/libssh2version unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe opensuse/leap15.0
  • cpe opensuse/leap42.3

Sources

  • CVE.orgVulnerability recordCVE-2019-3861

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-3861

    30-day exploitation probability 5.1%

    first.org
  • NIST NVDVulnerability recordCVE-2019-3861

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memor

    nvd.nist.gov

References

CVE-2019-3861 · ZeroDay Findings