9.1

CVE-2019-3859: debian debian_linux Out-of-bounds Read

Modified
AliasesALPINE-CVE-2019-3859SUSE-SU-2019:1059-1SUSE-SU-2019:1060-1
Published 20-03-2019Last modified 14-10-2026

Vulnerability summary

CVE-2019-3859 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 6.28% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 6% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
6.28%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 9
DLA-1730-1DLA-1730-3DSA-4431-1MGASA-2019-0139OPENSUSE-SU-2019:1109-1OPENSUSE-SU-2020:2126-1

Timeline

  1. 20-03-2019
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS metrics

9 scores · 5 sources · 3 versions

EPSS trend

Probability

6.28%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse19 products
  • libssh2_org&distro=SUSE Enterprise Storage 4< 1.4.3-20.6.1
  • libssh2_org&distro=SUSE Linux Enterprise Desktop 12 SP3< 1.4.3-20.6.1
  • libssh2_org&distro=SUSE Linux Enterprise Desktop 12 SP4< 1.4.3-20.6.1
  • libssh2_org&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.8.0-4.6.1
  • libssh2_org&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 1.2.9-4.2.12.8.1
Debian2 products
Opensuse2 products
  • leapEOL15.0 | 42.3
  • libssh2_org&distro=openSUSE Leap 15.0< 1.8.0-lp150.3.6.1
Alpine1 product
  • libssh2< 1.8.1-r0
Fedoraproject1 product
Libssh21 product
Netapp1 product
The libssh2 project1 product
Ubuntu1 product
  • libssh2< 1.4.3-2ubuntu0.2+esm2 | < 1.5.0-2ubuntu0.1+esm1 | All versions (No fix recorded)

9 vendors · 29 products

References

37 links
Show all 37 references