Every CVE Search/ Get API key

CVE-2019-5544

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has...

9.8 CriticalIn KEVPublic exploitFix available

CVE-2019-5544 is a critical vulnerability (CVSS 9.8) in Openslp, published December 6, 2019. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.1%, the 99th percentile. Fixed in openslp 2.0.0-26.

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

98.1%Up 90.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
CVE-2019-5544
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List 9.8

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
CVE-2019-5544
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2019-15119 9.8

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
EUVD-2019-15119
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4734-5452-r5fh 9.8

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has...

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
GHSA-4734-5452-r5fh
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CISA KEV No score

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.

Record
CVE-2019-5544
Weakness
CWE-787
Updated
2026-11-02
OSVAZL-36968 9.8

CVE-2019-5544 affecting package openslp for versions less than 2.0.0-26

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
AZL-36968
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVAZL-7321 9.8

CVE-2019-5544 affecting package openslp for versions less than 2.0.0-26

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
AZL-7321
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:4240 9.8

Red Hat Security Advisory: openslp security update

Record
RHSA-2019:4240
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:0199 9.8

Red Hat Security Advisory: openslp security update

Record
RHSA-2020:0199
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-5544 9.8

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Record
UBUNTU-CVE-2019-5544
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0075 No score

Updated openslp packages fix security vulnerability

A heap-based buffer overflow was discovered in OpenSLP in the way the slpd service processes URLs in service request messages. A remote unauthenticated attacker could register a service with a specially crafted URL that, when used during a service request message, would trigger the flaw and cause the program to crash or to remotely execute code with the privileges of the slpd service (CVE-2019-5544).

Record
MGASA-2020-0075
Updated
2026-11-02
OSVUSN-4919-1 No score

openslp-dfsg vulnerability

It was discovered that OpenSLP did not properly validate URLs. A remote attacker could use this issue to cause OpenSLP to crash or possibly execute arbitrary code.

Record
USN-4919-1
Updated
2026-11-02

Affected products

Show 5 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
openslp
Azure Linux:3
 before 2.0.0-26
2.0.0-26
openslp
Azure Linux:2
 before 2.0.0-26
2.0.0-26
openslp-dfsg
Debian:8
 before 1.2.1-10+deb8u2, plus listed versions
1.2.1-101.2.1-10+deb8u1
1.2.1-10+deb8u2
openslp
Mageia:7
 before 2.0.0-10.1.mga7
2.0.0-10.1.mga7
openslp
Red Hat:enterprise_linux:7::client
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-server
Red Hat:enterprise_linux:7::client
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-devel
Red Hat:enterprise_linux:7::client
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp
Red Hat:enterprise_linux:7::computenode
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
Show 28 moreShow less
Affected packages
PackageAffectedFixed
openslp-server
Red Hat:enterprise_linux:7::computenode
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-devel
Red Hat:enterprise_linux:7::computenode
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp
Red Hat:enterprise_linux:7::server
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-server
Red Hat:enterprise_linux:7::server
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-devel
Red Hat:enterprise_linux:7::server
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp
Red Hat:enterprise_linux:7::workstation
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-server
Red Hat:enterprise_linux:7::workstation
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp-devel
Red Hat:enterprise_linux:7::workstation
 before 1:2.0.0-8.el7_7
1:2.0.0-8.el7_7
openslp
Red Hat:enterprise_linux:6::client
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-debuginfo
Red Hat:enterprise_linux:6::client
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-devel
Red Hat:enterprise_linux:6::client
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-server
Red Hat:enterprise_linux:6::client
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp
Red Hat:enterprise_linux:6::computenode
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-devel
Red Hat:enterprise_linux:6::computenode
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-server
Red Hat:enterprise_linux:6::computenode
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp
Red Hat:enterprise_linux:6::server
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-debuginfo
Red Hat:enterprise_linux:6::server
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-devel
Red Hat:enterprise_linux:6::server
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-server
Red Hat:enterprise_linux:6::server
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-devel
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-server
Red Hat:enterprise_linux:6::workstation
 before 1:2.0.0-4.el6_10
1:2.0.0-4.el6_10
openslp-dfsg
Ubuntu:Pro:14.04:LTS
 before 1.2.1-9ubuntu0.3+esm1, plus listed versions
1.2.1-91.2.1-9ubuntu0.21.2.1-9ubuntu0.3
1.2.1-9ubuntu0.3+esm1
openslp-dfsg
Ubuntu:16.04:LTS
 before 1.2.1-11ubuntu0.16.04.2, plus listed versions
1.2.1-10ubuntu11.2.1-111.2.1-11ubuntu0.16.04.1
1.2.1-11ubuntu0.16.04.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubHynekPetrak/CVE-2019-5544_CVE-2020-39922020-12-01
PoC in GitHubdgh05t/VMware_ESXI_OpenSLP_PoCs2021-02-04
NucleiVMware ESXi SLP - Heap Overflow DoS

History

History
WhenChangedSources
2026-11-03exploitation, exploits
2026-11-02createdCVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open