CVE-2019-10648
Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
CVE-2019-10648- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
CVE-2019-10648- Updated
- 2026-11-02
EUVDEUVD-2019-0427 No score
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
EUVD-2019-0427- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2xp-75m7-gv52
Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
GHSA-q2xp-75m7-gv52- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-862
- Updated
- 2026-11-02
OSV
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
CVE-2019-10648- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10648
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
DEBIAN-CVE-2019-10648- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-q2xp-75m7-gv52
Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
GHSA-q2xp-75m7-gv52- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-862
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10648
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
- Record
UBUNTU-CVE-2019-10648- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-8385-1 No score
robocode vulnerabilities
It was discovered that Robocode could be tricked into making network requests to attacker-controlled systems. An attacker could possibly use this issue to cause external service interaction, resulting in information disclosure. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-10648)
Lim Sim Yee discovered that Robocode did not properly validate file paths in the CacheCleaner component. An attacker could possibly use this issue to delete arbitrary files. (CVE-2025-14306)
Lim Sim Yee discovered that Robocode did not securely create temporary files in the AutoExtract component. An attacker could possibly use this issue to manipulate temporary files, resulting in arbitrary code execution. (CVE-2025-14307)
Lim Sim Yee discovered that Robocode did not properly validate data lengths in the Buffer class. An attacker could possibly use this issue to trigger an integer overflow, resulting in arbitrary code execution. (CVE-2025-14308)
- Record
USN-8385-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
net.sf.robocode:robocode.hostMaven |
through 1.9.3.5 | 1.9.3.7 |
robocodeDebian:12 |
before 1.9.3.3-2 | 1.9.3.3-2 |
robocodeDebian:13 |
before 1.9.3.3-2 | 1.9.3.3-2 |
robocodeDebian:14 |
before 1.9.3.3-2 | 1.9.3.3-2 |
net.sf.robocode:robocode.hostMaven |
before 1.9.3.7 | 1.9.3.7 |
robocodeUbuntu:Pro:16.04:LTS |
before 1.9.2.5-2ubuntu0.1~esm1, plus listed versions 1.9.2.4-21.9.2.5-11.9.2.5-2 |
1.9.2.5-2ubuntu0.1~esm1 |
robocodeUbuntu:Pro:18.04:LTS |
before 1.9.3.1-1ubuntu0.1~esm1, plus listed versions 1.9.2.6-31.9.3.1-1 |
1.9.3.1-1ubuntu0.1~esm1 |
robocodeUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 1.9.2.5-2ubuntu0.1~esm1, plus listed versions 1.9.2.4-21.9.2.5-11.9.2.5-2 |
1.9.2.5-2ubuntu0.1~esm1 |
robocodeUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 1.9.3.1-1ubuntu0.1~esm1, plus listed versions 1.9.2.6-31.9.3.1-1 |
1.9.3.1-1ubuntu0.1~esm1 |
robocodeUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 1.9.3.7-1ubuntu0.1~esm1, plus listed versions 1.9.3.5-11.9.3.7-1 |
1.9.3.7-1ubuntu0.1~esm1 |
robocodeUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 1.9.3.9-2ubuntu0.1~esm1, plus listed versions 1.9.3.9-2 |
1.9.3.9-2ubuntu0.1~esm1 |
robocodeUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 1.9.3.9-3ubuntu0.1~esm1, plus listed versions 1.9.3.9-3 |
1.9.3.9-3ubuntu0.1~esm1 |
robocodeUbuntu:Pro:26.04:LTS From an advisory covering 4 CVEs |
before 1.9.3.9-4ubuntu0.26.04.1~esm1, plus listed versions 1.9.3.9-41.9.3.9-4build1 |
1.9.3.9-4ubuntu0.26.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10648 is a critical vulnerability (CVSS 9.8) in Robocode, published March 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in net.sf.robocode:robocode.host 1.9.3.7.