CVE-2019-1010022
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack...
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
- Record
CVE-2019-1010022- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
- Record
CVE-2019-1010022- Updated
- 2026-11-02
EUVDEUVD-2019-1772 No score
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
- Record
EUVD-2019-1772- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hqfh-jh33-mj7r
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack...
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.
- Record
GHSA-hqfh-jh33-mj7r- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
- Record
CVE-2019-1010022- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-1010022
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
- Record
DEBIAN-CVE-2019-1010022- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2019-1010022
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
- Record
UBUNTU-CVE-2019-1010022- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2019-1010022 No score
CVE-2019-1010022 in glibc - Patched by Root
Root has patched CVE-2019-1010022 in the glibc package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2019-1010022- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2019-1010022 No score
CVE-2019-1010022 in glibc - Patched by Root
Root has patched CVE-2019-1010022 in the glibc package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2019-1010022- Updated
- 2026-11-04
OSVROOT-OS-DEBIAN-13-CVE-2019-1010022 No score
CVE-2019-1010022 in glibc - Patched by Root
Root has patched CVE-2019-1010022 in the glibc package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2019-1010022- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glibcDebian:12 |
All versions, plus listed versions 2.36-10~02.36-92.36-9+deb12u12.36-9+deb12u102.36-9+deb12u11 Show 45 moreShow less2.36-9+deb12u122.36-9+deb12u132.36-9+deb12u142.36-9+deb12u22.36-9+deb12u32.36-9+deb12u42.36-9+deb12u52.36-9+deb12u62.36-9+deb12u72.36-9+deb12u82.36-9+deb12u92.36-9+loong642.37-12.37-102.37-112.37-122.37-132.37-142.37-152.37-15.12.37-15.1+sh42.37-15~deb13u12.37-162.37-172.37-182.37-192.37-22.37-32.37-42.37-52.37-62.37-72.37-82.37-92.38-12.38-102.38-112.38-122.38-12.12.38-132.38-142.38-15~02.38-15~12.38-22.38-3 |
None known |
glibcDebian:13 |
All versions, plus listed versions 2.41-122.41-12+deb13u12.41-12+deb13u22.41-12+deb13u32.41-12+deb13u4 Show 37 moreShow less2.41-13~hurd.02.41-13~hurd.12.42-12.42-102.42-112.42-122.42-12~hurd.12.42-132.42-142.42-14~hurd.12.42-152.42-15~hurd.12.42-162.42-172.42-22.42-32.42-42.42-52.42-62.42-72.42-82.42-8~hurd.12.42-8~hurd.22.42-92.43-12.43-22.43-32.43-3+m68k2.43-42.43-4+m68k2.43-52.43-62.43-72.43-7~hurd.12.44-12.44-22.44-3 |
None known |
glibcDebian:14 |
All versions, plus listed versions 2.41-122.41-13~hurd.02.41-13~hurd.12.42-12.42-10 Show 33 moreShow less2.42-112.42-122.42-12~hurd.12.42-132.42-142.42-14~hurd.12.42-152.42-15~hurd.12.42-162.42-172.42-22.42-32.42-42.42-52.42-62.42-72.42-82.42-8~hurd.12.42-8~hurd.22.42-92.43-12.43-22.43-32.43-3+m68k2.43-42.43-4+m68k2.43-52.43-62.43-72.43-7~hurd.12.44-12.44-22.44-3 |
None known |
glibcRoot:Debian:11 |
before 2.31-13+deb11u14.aikido.15 | 2.31-13+deb11u14.aikido.152.31-13+deb11u14.root.io.14 |
rootio-glibcRoot:Debian:11 |
before 2.31-13+deb11u14.aikido.15 | 2.31-13+deb11u14.aikido.152.31-13+deb11u14.root.io.14 |
glibcRoot:Debian:12 |
before 2.36-9+deb12u14.root.io.18 | 2.36-9+deb12u14.root.io.182.36-9+deb12u14.root.io.192.36-9+deb12u14.aikido.202.36-9+deb12u14.aikido.212.36-9+deb12u14.aikido.222.36-9+deb12u14.aikido.232.36-9+deb12u14.aikido.24 |
rootio-glibcRoot:Debian:12 |
before 2.36-9+deb12u14.root.io.18 | 2.36-9+deb12u14.root.io.182.36-9+deb12u14.root.io.192.36-9+deb12u14.aikido.202.36-9+deb12u14.aikido.212.36-9+deb12u14.aikido.222.36-9+deb12u14.aikido.232.36-9+deb12u14.aikido.24 |
glibcRoot:Debian:13 |
before 2.41-12+deb13u4.aikido.13 | 2.41-12+deb13u4.aikido.132.41-12+deb13u4.aikido.14 |
rootio-glibcRoot:Debian:13 |
before 2.41-12+deb13u4.aikido.13 | 2.41-12+deb13u4.aikido.132.41-12+deb13u4.aikido.14 |
glibcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.21-0ubuntu42.21-0ubuntu52.21-0ubuntu62.23-0ubuntu12.23-0ubuntu2 Show 18 moreShow less2.23-0ubuntu32.23-0ubuntu42.23-0ubuntu52.23-0ubuntu62.23-0ubuntu72.23-0ubuntu92.23-0ubuntu102.23-0ubuntu112.23-0ubuntu11.22.23-0ubuntu11.32.23-0ubuntu11.3+esm12.23-0ubuntu11.3+esm22.23-0ubuntu11.3+esm32.23-0ubuntu11.3+esm52.23-0ubuntu11.3+esm62.23-0ubuntu11.3+esm72.23-0ubuntu11.3+esm82.23-0ubuntu11.3+esm9 |
None known |
glibcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.26-0ubuntu22.26-0ubuntu2.12.27-0ubuntu22.27-0ubuntu32.27-3ubuntu1 Show 11 moreShow less2.27-3ubuntu1.22.27-3ubuntu1.32.27-3ubuntu1.42.27-3ubuntu1.52.27-3ubuntu1.62.27-3ubuntu1.6+esm12.27-3ubuntu1.6+esm22.27-3ubuntu1.6+esm32.27-3ubuntu1.6+esm42.27-3ubuntu1.6+esm52.27-3ubuntu1.6+esm6 |
None known |
glibcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.30-0ubuntu22.30-0ubuntu32.31-0ubuntu52.31-0ubuntu62.31-0ubuntu7 Show 13 moreShow less2.31-0ubuntu92.31-0ubuntu9.12.31-0ubuntu9.22.31-0ubuntu9.32.31-0ubuntu9.72.31-0ubuntu9.92.31-0ubuntu9.122.31-0ubuntu9.142.31-0ubuntu9.152.31-0ubuntu9.162.31-0ubuntu9.172.31-0ubuntu9.182.31-0ubuntu9.18+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1010022 is a critical vulnerability (CVSS 9.8) in Gnu Glibc, published July 15, 2019. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 3.25%, the 88th percentile. Fixed in glibc 2.31-13+deb11u14.aikido.15.
References
sourceware.org/bugzilla/show_bug.cgi?id=22850
security-tracker.debian.org/tracker/CVE-2019-1010022
ubuntu.com/security/CVE-2019-1010022
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2019-1010022
github.com/advisories/GHSA-hqfh-jh33-mj7r
cve.org/CVERecord?id=CVE-2019-1010022
Left out here: 86 versions. The JSON record has them.