CVE-2019-15605: debian debian_linux

Modified

AliasesALPINE-CVE-2019-15605MGASA-2020-0131RHSA-2020:0703+5 more

Published 07-02-2020Last modified 30-04-2025

Vulnerability summary

CVE-2019-15605 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 57.13% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 57% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

57.13%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 7

DSA-4669-1 MGASA-2020-0372 OPENSUSE-SU-2020:0293-1 RHSA-2020:0573 RHSA-2020:0579 RHSA-2020:0597+8 more

Timeline

07-02-2020
PublishedVulnerability first disclosed.
30-04-2025
Last modifiedVulnerability information updated.

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS metrics

6 scores · 5 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

57.13%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 57.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat12 products

enterprise_linux8.0
enterprise_linux_desktop7.0
enterprise_linux_eus7.7 | 8.1 | 8.2 | 8.4 | 8.6
enterprise_linux_server7.0
enterprise_linux_server_aus7.7 | 8.2 | 8.4 | 8.6

Show all 12

Debian3 products

http-parser< 2.9.4-2
nodejs< 10.19.0~dfsg-1
debian_linuxEOL10.0

Alpine2 products

nodejs< 10.19.0-r0 | < 12.15.0-r0
nodejs-current< 13.11.0-r0

Nodejs2 products

node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.19.0 | ≥ 11.0, < 11.* | ≥ 12.0, < 12.15.0 | ≥ 13.0, < 13.8.0
node.js≥ 10.0.0, < 10.19.0 | ≥ 12.0.0, < 12.15.0 | ≥ 13.0.0, < 13.8.0

Fedoraproject1 product

fedoraEOL30

Mageia1 product

http-parser< 2.9.3-1.mga7

Opensuse1 product

leapEOL15.1

Oracle1 product

graalvmEOL19.3.1 | 20.0.0

Ubuntu1 product

nodejsAll versions (No fix recorded) | < 4.2.6~dfsg-1ubuntu4.2+esm2 | < 8.10.0~dfsg-2ubuntu0.4+esm2

9 vendors · 24 products

References

37 links

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2020:0573Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2020:0579Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2020:0597Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2020:0598Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2020:0602Vendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2020:0703Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
access.redhat.com/errata/RHSA-2020:0707Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory

Show all 37 references

access.redhat.com/errata/RHSA-2020:0708Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
security.gentoo.org/glsa/202003-48Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.debian.org/security/2020/dsa-4669Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISCPatchThird Party Advisory
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCPatchThird Party Advisory
nodejs.org/en/blog/release/v13.8.0/X Refsource CONFIRMVendor AdvisoryREPORT
nodejs.org/en/blog/vulnerability/february-2020-security-releases/X Refsource CONFIRMVendor AdvisoryARTICLE
nodejs.org/en/blog/release/v10.19.0/X Refsource CONFIRMRelease NotesVendor Advisory
nodejs.org/en/blog/release/v12.15.0/X Refsource CONFIRMRelease NotesVendor Advisory
security.netapp.com/advisory/ntap-20200221-0004/X Refsource CONFIRMThird Party Advisory
hackerone.com/reports/735748X Refsource MISCPermissions RequiredThird Party AdvisoryREPORT
security.alpinelinux.org/vuln/CVE-2019-15605Advisory
advisories.mageia.org/MGASA-2020-0131.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=26293REPORT
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1800364REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0703.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-15605REPORT
www.cve.org/CVERecord?id=CVE-2019-15605AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-15605Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0707.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0708.jsonAdvisory
access.redhat.com/errata/RHSA-2020:1510Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1510.jsonAdvisory
ubuntu.com/security/CVE-2019-15605REPORT
ubuntu.com/security/notices/USN-6380-1Advisory
security-tracker.debian.org/tracker/CVE-2019-15605Advisory