Every CVE Search/ Get API key

CVE-2019-17596

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic...

7.5 HighPublic exploitFix available

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.69%Down 6.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
CVE-2019-17596
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-436
Updated
2026-11-02
CVE List No score

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
CVE-2019-17596
Updated
2026-11-02
EUVDEUVD-2019-7924 No score

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
EUVD-2019-7924
Updated
2026-11-03
GitHub AdvisoriesGHSA-gcr4-wcqh-3624 No score

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic...

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
GHSA-gcr4-wcqh-3624
Weakness
CWE-436
Updated
2026-11-02
OSVALPINE-CVE-2019-17596 7.5

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
ALPINE-CVE-2019-17596
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-79090 7.5

CVE-2019-17596 affecting package golang 1.25.7-1

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
AZL-79090
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVAZL-98898 7.5

CVE-2019-17596 affecting package golang 1.27.1-1

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
AZL-98898
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2019-17596 7.5

CVE-2019-17596 does not affect BellSoft software

Record
BELL-CVE-2019-17596
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
CVE-2019-17596
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHBA-2020:0390 7.5

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.1 packages update

Record
RHBA-2020:0390
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:0101 7.5

Red Hat Security Advisory: go-toolset-1.12-golang security update

Record
RHSA-2020:0101
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:0329 7.5

Red Hat Security Advisory: go-toolset:rhel8 security update

Record
RHSA-2020:0329
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-17596 7.5

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

Record
UBUNTU-CVE-2019-17596
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGO-2022-0213 No score

Panic on invalid DSA public keys in crypto/dsa

Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key.

Record
GO-2022-0213
Updated
2026-11-02
OSVMGASA-2019-0310 No score

Updated golang packages fix security vulnerability

Updated golang packages fix security vulnerability:

Daniel Mandragona discovered that invalid DSA public keys can cause a panic in dsa.Verify(), resulting in denial of service (CVE-2019-17596).

Record
MGASA-2019-0310
Updated
2026-11-02
OSVopenSUSE-SU-2019:2521-1 No score

Security update for go1.12

This update for go1.12 fixes the following issues:

Security issues fixed:

  • CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
  • CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).

Non-security issue fixed:

  • Go was updated to version 1.12.12 (bsc#1141689).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2521-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2522-1 No score

Security update for go1.12

This update for go1.12 fixes the following issues:

Security issues fixed:

  • CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
  • CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).

Non-security issue fixed:

  • Go was updated to version 1.12.12 (bsc#1141689).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2522-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score

go1.12-1.12.17-4.8 on GA media

These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10805-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10806-1 No score

go1.13-1.13.15-2.6 on GA media

These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10806-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11098-1 No score

notary-0.7.0-1.2 on GA media

These are all security issues fixed in the notary-0.7.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11098-1
Updated
2026-11-02
OSVSUSE-SU-2019:2940-1 No score

Security update for go1.12

This update for go1.12 fixes the following issues:

Security issues fixed:

  • CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
  • CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).

Non-security issue fixed:

  • Go was updated to version 1.12.12 (bsc#1141689).
Record
SUSE-SU-2019:2940-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
containerd
Alpine:v3.11
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.12
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.13
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.14
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.15
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.16
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.17
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.18
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.19
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.20
 before 1.3.1-r0
1.3.1-r0
Show 69 moreShow less
Affected packages
PackageAffectedFixed
containerd
Alpine:v3.21
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.22
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.23
 before 1.3.1-r0
1.3.1-r0
containerd
Alpine:v3.24
 before 1.3.1-r0
1.3.1-r0
go
Alpine:v3.10
 1.12 up to 1.12.11-r0
1.12.11-r0
go
Alpine:v3.11
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.12
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.13
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.14
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.15
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.16
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.17
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.18
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.19
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.20
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.21
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.22
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.23
 1.12 up to 1.13.2-r0
1.13.2-r0
go
Alpine:v3.24
 1.12 up to 1.13.2-r0
1.13.2-r0
golang
Azure Linux:3
 through 1.25.7-1 None known
golang
Azure Linux:3
 1.27.0 to 1.27.1-1 None known
golang-1.7
Debian:9
From an advisory covering 7 CVEs
 before 1.7.4-2+deb9u3, plus listed versions
1.7.4-21.7.4-2+deb9u11.7.4-2+deb9u2
1.7.4-2+deb9u3
golang-1.8
Debian:9
From an advisory covering 7 CVEs
 before 1.8.1-1+deb9u3, plus listed versions
1.8.1-11.8.1-1+deb9u11.8.1-1+deb9u2
1.8.1-1+deb9u3
golang-1.11
Debian:10
 before 1.11.6-1+deb10u3, plus listed versions
1.11.6-11.11.6-1+deb10u11.11.6-1+deb10u2
1.11.6-1+deb10u3
stdlib
Go
 before 1.12.11, 1.13.0-0 up to 1.13.2
1.12.111.13.2
golang
Mageia:7
 before 1.12.11-1.mga7
1.12.11-1.mga7
cri-o
Red Hat:openshift:4.3::el7
From an advisory covering 3 CVEs
 before 0:1.16.2-13.dev.rhaos4.3.gita83f883.el7
0:1.16.2-13.dev.rhaos4.3.gita83f883.el7
openshift
Red Hat:openshift:4.3::el7
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.0.331f390.el7
0:4.3.1-202001310552.git.0.331f390.el7
openshift-clients
Red Hat:openshift:4.3::el7
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.1.075d46a.el7
0:4.3.1-202001310552.git.1.075d46a.el7
openshift-clients-redistributable
Red Hat:openshift:4.3::el7
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.1.075d46a.el7
0:4.3.1-202001310552.git.1.075d46a.el7
openshift-hyperkube
Red Hat:openshift:4.3::el7
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.0.331f390.el7
0:4.3.1-202001310552.git.0.331f390.el7
cri-o
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:1.16.2-15.dev.rhaos4.3.gita83f883.el8
0:1.16.2-15.dev.rhaos4.3.gita83f883.el8
openshift
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.0.331f390.el8
0:4.3.1-202001310552.git.0.331f390.el8
openshift-clients
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.1.075d46a.el8
0:4.3.1-202001310552.git.1.075d46a.el8
openshift-clients-redistributable
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.1.075d46a.el8
0:4.3.1-202001310552.git.1.075d46a.el8
openshift-hyperkube
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:4.3.1-202001310552.git.0.331f390.el8
0:4.3.1-202001310552.git.0.331f390.el8
slirp4netns
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:0.4.2-3.git21fdece.el8
0:0.4.2-3.git21fdece.el8
slirp4netns-debuginfo
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:0.4.2-3.git21fdece.el8
0:0.4.2-3.git21fdece.el8
slirp4netns-debugsource
Red Hat:openshift:4.3::el8
From an advisory covering 3 CVEs
 before 0:0.4.2-3.git21fdece.el8
0:0.4.2-3.git21fdece.el8
go-toolset-1.12
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-build
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang-bin
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang-docs
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang-misc
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang-race
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang-src
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-golang-tests
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset-1.12-runtime
Red Hat:devtools:2019
From an advisory covering 2 CVEs
 before 0:1.12.12-4.el7
0:1.12.12-4.el7
go-toolset
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-2.module+el8.1.0+5317+8a49ffbb
0:1.12.12-2.module+el8.1.0+5317+8a49ffbb
golang
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-bin
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-misc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-race
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-src
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-tests
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
0:1.12.12-4.module+el8.1.0+5317+8a49ffbb
golang-1.10
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~14.04.1
 None known
golang-1.10
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2
 None known
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
golang-1.10
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
golang-1.9
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1
 None known
golang-1.13
Ubuntu:20.04:LTS
 before 1.13.3-1ubuntu1, plus listed versions
1.13.1-1ubuntu1
1.13.3-1ubuntu1
go1.12
openSUSE:Leap 15.0
From an advisory covering 2 CVEs
 before 1.12.12-lp150.11.1
1.12.12-lp150.11.1
go1.12
openSUSE:Leap 15.1
From an advisory covering 2 CVEs
 before 1.12.12-lp151.2.25.1
1.12.12-lp151.2.25.1
go1.12
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 1.12.17-4.8
1.12.17-4.8
go1.13
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.13.15-2.6
1.13.15-2.6
notary
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.7.0-1.2
0.7.0-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubpquerna/poc-dsa-verify-CVE-2019-175962019-10-19

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17596 is a high vulnerability (CVSS 7.5) in Golang Go, published October 24, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.69%, the 91st percentile. Fixed in containerd 1.3.1-r0.

References

Show 73 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open