CVE-2019-6477: TCP-pipelined queries can bypass tcp-clients limit
Vulnerability summary
CVE-2019-6477 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in fedoraproject fedora. EPSS estimates a 4.13% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 26-11-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
CVSS metrics
9 scores · 8 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.13%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Increase +0.08 pp
From 4.06% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat27 products
- bind< 32:9.11.13-3.el8
- bind-chroot< 32:9.11.13-3.el8
- bind-debuginfo< 32:9.11.13-3.el8
- bind-debugsource< 32:9.11.13-3.el8
- bind-devel< 32:9.11.13-3.el8
Isc2 products
- bind≥ 9.11.7, ≤ 9.11.12 | ≥ 9.14.1, ≤ 9.14.7 | ≥ 9.15.0, ≤ 9.15.5 | 9.11.5:s6 | 9.11.6:p1 | 9.11.6:rc1 | 9.11.12:s1 | 9.12.4:p1 | 9.12.4:p2
- bind99.11.6-P1 -> 9.11.12, 9.12.4-P1 -> 9.12.4-P2, 9.14.1 -> 9.14.7, and versions 9.11.5-S6 -> 9.11.12-S1 of BIND 9 Supported Preview Edition. Versions 9.15.0 -> 9.15.5 of the BIND 9.15 development branch are also affected
Alpine1 product
- bind≥ 9.11.7, < 9.14.8-r0
Chainguard1 product
- bindAll versions (No fix recorded)
Debian1 product
- bind9< 1:9.11.14+dfsg-1
Fedoraproject1 product
- fedoraEOL30 | 31
Ubuntu1 product
- bind9< 1:9.11.3+dfsg-1ubuntu1.11
Wolfi1 product
- bindAll versions (No fix recorded)
8 vendors · 35 products
References
25 links- support.f5.com/csp/article/K15840535?utm_source=f5support&%3Butm_medium=RSSX Refsource CONFIRMWEB
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlVendor AdvisoryX Refsource SUSEWEB
