Every CVE Search/ Get API key

CVE-2019-5163

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of...

5.9 MediumFix available

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.66%Up 1.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.9

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
CVE-2019-5163
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-306
Updated
2026-11-02
EUVDEUVD-2019-14768 5.9

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
EUVD-2019-14768
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-vc3w-rpc8-4w8g 7.5

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of...

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
GHSA-vc3w-rpc8-4w8g
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-306, CWE-327
Updated
2026-11-02
NVD 7.5

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
CVE-2019-5163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-306
Updated
2026-11-02
OSV 7.5

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
CVE-2019-5163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-5163 7.5

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
DEBIAN-CVE-2019-5163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2019-5163 7.5

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

Record
UBUNTU-CVE-2019-5163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2020-0006 No score

Updated shadowsocks-libev packages fix security vulnerabilities

Updated shadowsocks-libev packages fix security vulnerabilities:

Exploitable denial-of-service vulnerability exists in the UDPRelay functionality (CVE-2019-5163).

Code execution vulnerability in the ss-manager binary (CVE-2019-5164).

Record
MGASA-2020-0006
Updated
2026-11-02
OSVopenSUSE-SU-2019:2667-1 No score

Security update for shadowsocks-libev

This update for shadowsocks-libev fixes the following issues:

  • Update version to 3.3.3
    • Refine the handling of suspicious connections.
    • Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163)
    • Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164)
    • Refine the handling of fragment request.
    • Fix a high CPU bug introduced in 3.3.0. (#2449)
    • Enlarge the socket buffer size to 16KB.
    • Fix the empty list bug in ss-manager.
    • Fix the IPv6 address parser.
    • Fix a bug of port parser.
    • Fix a crash with MinGW.
    • Refine SIP003 plugin interface.
    • Remove connection timeout from all clients.
    • Fix the alignment bug again.
    • Fix a bug on 32-bit arch.
    • Add TCP fast open support to ss-tunnel by @PantherJohn.
Record
openSUSE-SU-2019:2667-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0142-1 No score

Security update for shadowsocks-libev

This update for shadowsocks-libev fixes the following issues:

  • Update version to 3.3.3
    • Refine the handling of suspicious connections.
    • Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163)
    • Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164)
    • Refine the handling of fragment request.
    • Fix a high CPU bug introduced in 3.3.0. (#2449)
    • Enlarge the socket buffer size to 16KB.
    • Fix the empty list bug in ss-manager.
    • Fix the IPv6 address parser.
    • Fix a bug of port parser.
    • Fix a crash with MinGW.
    • Refine SIP003 plugin interface.
    • Remove connection timeout from all clients.
    • Fix the alignment bug again.
    • Fix a bug on 32-bit arch.
    • Add TCP fast open support to ss-tunnel by @PantherJohn.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2020:0142-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11379-1 No score

libshadowsocks-libev2-3.3.5-1.9 on GA media

These are all security issues fixed in the libshadowsocks-libev2-3.3.5-1.9 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11379-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shadowsocks-libev
Debian:12
 before 3.3.3+ds-2
3.3.3+ds-2
shadowsocks-libev
Debian:13
 before 3.3.3+ds-2
3.3.3+ds-2
shadowsocks-libev
Mageia:7
 before 3.3.3-1.mga7
3.3.3-1.mga7
shadowsocks-libev
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.8+ds-23.1.0+ds-33.1.0+ds-43.1.0+ds-53.1.1+ds-1
Show 4 moreShow less
3.1.1+ds-23.1.1+ds-33.1.3+ds-1ubuntu13.1.3+ds-1ubuntu2
 None known
shadowsocks-libev
openSUSE:Leap 15.1
 before 3.3.3-lp151.2.3.1
3.3.3-lp151.2.3.1
shadowsocks-libev
SUSE:Package Hub 15 SP1
 before 3.3.3-bp151.5.3.1
3.3.3-bp151.5.3.1
shadowsocks-libev
openSUSE:Tumbleweed
 before 3.3.5-1.9
3.3.5-1.9

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-5163 is a medium vulnerability (CVSS 5.9) in Shadowsocks Shadowsocks-libev, published December 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in shadowsocks-libev 3.3.3+ds-2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open