ZeroDay Findings
Sign inSign up

Findings

CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Published May 28, 2019 · updated Oct 14, 2026 · haxx libcurl

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 28, 2019 · NIST NVD

    Detected

    A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux9.0
  • cpe f5/traffix signaling delivery controllerversion unspecified
  • cpe fedoraproject/fedora29
  • cpe haxx/libcurlversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe opensuse/leap15.0
  • cpe opensuse/leap15.1
  • cpe opensuse/leap42.3
  • cpe oracle/enterprise manager ops center12.3.3

Sources

  • CVE.orgVulnerability recordCVE-2019-5436

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-5436

    30-day exploitation probability 49.7%

    first.org
  • NIST NVDVulnerability recordCVE-2019-5436

    A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

    nvd.nist.gov

References