CVE-2019-10091

Apache Geode SSL endpoint verification vulnerability

7.4 HighFix available

CVE-2019-10091 is a high vulnerability (CVSS 7.4) in Apache Geode, published March 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 72nd percentile. Fixed in org.apache.geode:geode-core 1.10.0.

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.42%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 7.4

Record: CVE-2019-10091
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:H/Au:N/C:P/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-10091
Updated: 2026-11-02

EUVDEUVD-2022-1223 No score

Record: EUVD-2022-1223
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wc4x-4gm2-74j8 7.4

Apache Geode SSL endpoint verification vulnerability

Record: GHSA-wc4x-4gm2-74j8
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSV 7.4

Record: CVE-2019-10091
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-wc4x-4gm2-74j8 7.4