CVE-2019-16276: debian debian_linux

Modified

AliasesRHBA-2019:3304UBUNTU-CVE-2019-16276DSA-4534-1+2 more

Published 30-09-2019Last modified 05-08-2024

Vulnerability summary

CVE-2019-16276 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 5.30% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

5.30%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 4

DLA-2591-1 DLA-2592-1 OPENSUSE-SU-2019:2521-1 OPENSUSE-SU-2019:2522-1 OPENSUSE-SU-2024:10805-1 OPENSUSE-SU-2024:10806-1+2 more

Timeline

30-09-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

CVSS metrics

5 scores · 4 sources · 3 versions

v3.17.5v3.06.5v2.05.0

EPSS trend

Probability

5.30%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.30% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat12 products

developer_tools1.0
enterprise_linux8.0
enterprise_linux_eus8.1
openshift_container_platform4.2
atomic-enterprise-service-catalog< 1:4.2.4-201911041319.git.1.1de4bcd.el7

Show all 12

Ubuntu4 products

golang-1.10All versions (No fix recorded)
golang-1.6All versions (No fix recorded)
golang-1.8All versions (No fix recorded)
golang-1.9All versions (No fix recorded)

Debian2 products

golang-1.11< 1.11.6-1+deb10u2
debian_linuxEOL9.0

Alpine1 product

go≥ 1.13, < 1.12.10-r0 | ≥ 1.13, < 1.13.1-r0

Fedoraproject1 product

fedoraEOL29 | 30 | 31

Go1 product

stdlib≥ 1.13.0-0, < 1.13.1

Golang1 product

go< 1.12.10 | ≥ 1.13, < 1.13.1

Netapp1 product

cloud_insights_telegraf_agentna

Opensuse1 product

leapEOL15.0 | 15.1

9 vendors · 24 products

References

30 links

github.com/golang/go/issues/34540X Refsource CONFIRMPatchThird Party Advisory
groups.google.com/forum/X Refsource MISC
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20191122-0004/X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2020:0101Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2020:0329Vendor AdvisoryX Refsource REDHATThird Party Advisory

Show all 30 references

access.redhat.com/errata/RHSA-2020:0652Vendor AdvisoryX Refsource REDHATThird Party Advisory
lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory
access.redhat.com/errata/RHBA-2019:3304Advisory
bugzilla.redhat.com/show_bug.cgi?id=1765304REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_3304.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-16276REPORT
bugzilla.redhat.com/show_bug.cgi?id=1755969REPORT
www.cve.org/CVERecord?id=CVE-2019-16276AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-16276AdvisoryOval
groups.google.com/forum/ARTICLE
ubuntu.com/security/CVE-2019-16276REPORT
groups.google.com/forum/m/REPORT
github.com/golang/go/commit/5a6ab1ec3e678640befebeb3318b746a64ad986cREPORT
github.com/golang/go/commit/6e6f4aaf70c8b1cc81e65a26332aa9409de03ad8REPORT
go.dev/cl/197503FIX
go.googlesource.com/go/+/41b1f88efab9d263408448bf139659119002ea50FIX
go.dev/issue/34540REPORT
groups.google.com/g/golang-announce/c/cszieYyuL9Q/m/g4Z7pKaqAgAJWEB
security.alpinelinux.org/vuln/CVE-2019-16276Advisory