CVE-2019-5062
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for...
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
CVE-2019-5062- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-440
- Updated
- 2026-11-02
EUVDEUVD-2019-14669
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
EUVD-2019-14669- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gv78-7qxh-6mj5
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for...
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
GHSA-gv78-7qxh-6mj5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-346, CWE-440
- Updated
- 2026-11-02
NVD
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
CVE-2019-5062- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.4 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - CVSS 2.0
- 3.3 Low
AV:A/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-440, CWE-346
- Updated
- 2026-11-02
OSV
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
CVE-2019-5062- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-5062
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
DEBIAN-CVE-2019-5062- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-5062
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
- Record
UBUNTU-CVE-2019-5062- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.4 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wpaDebian:12 |
All versions, plus listed versions 2:2.10-122:2.10-12+deb12u12:2.10-12+deb12u22:2.10-12+deb12u32:2.10-13 Show 14 moreShow less2:2.10-142:2.10-152:2.10-162:2.10-172:2.10-182:2.10-202:2.10-212:2.10-21.12:2.10-222:2.10-232:2.10-242:2.10-252:2.11-12:2.11-2 |
None known |
wpaDebian:13 |
All versions, plus listed versions 2:2.10-242:2.10-252:2.11-12:2.11-2 |
None known |
wpaDebian:14 |
All versions, plus listed versions 2:2.10-242:2.10-252:2.11-12:2.11-2 |
None known |
wpaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.0-3ubuntu21.0-3ubuntu31.0-3ubuntu42.1-0ubuntu12.1-0ubuntu1.1 Show 11 moreShow less2.1-0ubuntu1.22.1-0ubuntu1.32.1-0ubuntu1.42.1-0ubuntu1.52.1-0ubuntu1.62.1-0ubuntu1.72.1-0ubuntu1.7+esm12.1-0ubuntu1.7+esm22.1-0ubuntu1.7+esm32.1-0ubuntu1.7+esm42.1-0ubuntu1.7+esm5 |
None known |
wpaUbuntu:16.04:LTS |
All versions, plus listed versions 2.4-0ubuntu32.4-0ubuntu42.4-0ubuntu52.4-0ubuntu62.4-0ubuntu6.2 Show 7 moreShow less2.4-0ubuntu6.32.4-0ubuntu6.42.4-0ubuntu6.52.4-0ubuntu6.62.4-0ubuntu6.72.4-0ubuntu6.82.4-0ubuntu6.8+esm1 |
None known |
wpaUbuntu:18.04:LTS |
All versions, plus listed versions 2.4-0ubuntu102:2.4-1.1ubuntu12:2.6-15ubuntu12:2.6-15ubuntu22:2.6-15ubuntu2.1 Show 8 moreShow less2:2.6-15ubuntu2.22:2.6-15ubuntu2.32:2.6-15ubuntu2.42:2.6-15ubuntu2.52:2.6-15ubuntu2.62:2.6-15ubuntu2.72:2.6-15ubuntu2.82:2.6-15ubuntu2.8+esm1 |
None known |
wpaUbuntu:20.04:LTS |
All versions, plus listed versions 2:2.9-1ubuntu22:2.9-1ubuntu32:2.9-1ubuntu42:2.9-1ubuntu4.12:2.9-1ubuntu4.22:2.9-1ubuntu4.32:2.9-1ubuntu4.42:2.9-1ubuntu4.6 |
None known |
wpaUbuntu:22.04:LTS |
All versions, plus listed versions 2:2.9.0-21build12:2.9.0-232:2.10-12:2.10-22:2.10-6 Show 6 moreShow less2:2.10-6ubuntu12:2.10-6ubuntu22:2.10-6ubuntu2.12:2.10-6ubuntu2.22:2.10-6ubuntu2.32:2.10-6ubuntu2.4 |
None known |
wpaUbuntu:24.04:LTS |
All versions, plus listed versions 2:2.10-152:2.10-182:2.10-202:2.10-212:2.10-21build2 Show 6 moreShow less2:2.10-21build32:2.10-21build42:2.10-21ubuntu0.12:2.10-21ubuntu0.22:2.10-21ubuntu0.32:2.10-21ubuntu0.4 |
None known |
wpaUbuntu:25.10 |
All versions, plus listed versions 2:2.10-242:2.11-0ubuntu12:2.11-0ubuntu22:2.11-0ubuntu32:2.11-0ubuntu4 |
None known |
wpaUbuntu:26.10 |
All versions, plus listed versions 2:2.11-0ubuntu52:2.11-2ubuntu2 |
None known |
wpaUbuntu:26.04:LTS |
All versions, plus listed versions 2:2.11-0ubuntu42:2.11-0ubuntu5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-5062 is a high vulnerability (CVSS 7.4) in W1.fi Hostapd, published December 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. No source names a fixed version.