{"id":"CVE-2019-13115","aliases":["ALPINE-CVE-2019-13115","BELL-CVE-2019-13115","CLSA-2026-1776864708","CLSA-2026-1778159627","DEBIAN-CVE-2019-13115","DLA-1730-3","DLA-2848-1","DLA-3559-1","EUVD-2019-4656","GHSA-98vm-qgxx-5rjm","UBUNTU-CVE-2019-13115","USN-5308-1"],"status":"published","title":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c...","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.11659,"percentile":0.96083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125","CWE-190"],"published":"2019-07-16T00:00:00Z","modified":"2026-10-20T10:48:14Z","exploits":[{"source":"pocgithub","id":"CSSProject/libssh2-Exploit","title":"CSSProject/libssh2-Exploit","date":"2019-10-03","url":"https://github.com/CSSProject/libssh2-Exploit"},{"source":"pocgithub","id":"viz27/Libssh2-Exploit","title":"viz27/Libssh2-Exploit","date":"2019-10-03","url":"https://github.com/viz27/Libssh2-Exploit"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libssh2","fixed_in":["1.9.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh2","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh2","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh2","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libssh2","fixed_in":["1.4.3-2ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh2","fixed_in":["1.5.0-2ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh2-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu0.1+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh2-1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu0.1+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.0.1.el6_10.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libssh2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.0.1.el6_10.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libssh2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.0.1.el6_10.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-4.1+deb8u4"}]}],"versions":["1.4.3-4.1","1.4.3-4.1+deb8u1","1.4.3-4.1+deb8u2","1.4.3-4.1+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1+deb9u2"}]}],"versions":["1.7.0-1","1.7.0-1+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.1+deb10u1"}]}],"versions":["1.8.0-2.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-2ubuntu0.2+esm2"}]}],"versions":["1.4.3-1","1.4.3-2","1.4.3-2ubuntu0.1","1.4.3-2ubuntu0.2","1.4.3-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu0.1+esm1"}]}],"versions":["1.5.0-2","1.5.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.0-1ubuntu0.1","1.8.0-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-2.1build1","1.8.0-2.1ubuntu0.1","1.8.0-2.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu0.1+esm1"}]}],"versions":["1.5.0-2","1.5.0-2ubuntu0.1"],"bundled":11}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"traffix_systems_signaling_delivery_controller"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libssh2","product":"libssh2"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"}],"references":[{"url":"https://github.com/libssh2/libssh2/pull/350","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://libssh2.org/changes.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://blog.semmle.com/libssh2-integer-overflow/","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190806-0002/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K13322484","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K13322484?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13115"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/"},{"url":"https://support.f5.com/csp/article/K13322484?utm_source=f5support\u0026amp;utm_medium=RSS"},{"url":"https://github.com/advisories/GHSA-98vm-qgxx-5rjm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13115","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-13115","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1776864708.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1778159627.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13115","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13115","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5308-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17498","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T00:00:00Z","modified":"2024-08-04T23:41:10.457Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4656","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T00:00:00Z","modified":"2024-08-04T23:41:10Z","updated_at":"2026-11-03T02:40:43.860719Z"}],"ghsa":[{"id":"GHSA-98vm-qgxx-5rjm","title":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c...","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds write in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2022-05-24T16:50:28Z","modified":"2023-06-21T05:00:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:38.89081Z"}],"nvd":[{"id":"CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T18:15:13.287Z","modified":"2026-06-17T02:16:05.543Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-02T14:05:20.616405Z"}],"osv":[{"id":"ALPINE-CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T18:15:13.287Z","modified":"2026-09-21T06:17:52.471021701Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-13115","title":"CVE-2019-13115 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:14.598743Z","modified":"2026-01-26T09:47:53.555259Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T18:15:13.287Z","modified":"2026-10-20T10:48:14.921739044Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T18:15:13.287Z","modified":"2026-09-21T07:02:17.058665541Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.","status":"published","published":"2019-07-16T18:15:00Z","modified":"2026-09-22T15:33:10.035937319Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"CLSA-2026-1776864708","title":"Fix CVE(s): CVE-2019-13115, CVE-2019-3855, CVE-2019-3856, CVE-2019-3863","description":"   * SECURITY UPDATE: integer overflow in transport read allowing\n     out-of-bounds write via crafted SSH packet\n     - debian/patches/CVE-2019-3855.patch: add packet_length bounds\n       check against LIBSSH2_PACKET_MAXPAYLOAD in transport read\n     - CVE-2019-3855\n   * SECURITY UPDATE: integer overflow in keyboard-interactive handling\n     allowing out-of-bounds write via crafted num-prompts value\n     - debian/patches/CVE-2019-3856.patch: cap num_prompts at 100 to\n       prevent excessive allocation in keyboard-interactive auth\n     - CVE-2019-3856\n   * SECURITY UPDATE: integer overflow in keyboard-interactive response\n     allowing out-of-bounds write via crafted response lengths\n     - debian/patches/CVE-2019-3863.patch: add SIZE_MAX overflow check\n       in keyboard-interactive response packet length calculation\n     - CVE-2019-3863\n   * SECURITY UPDATE: out-of-bounds memory access in kex exchange when\n     reading malformed data in diffie_hellman_sha1/sha256\n     - debian/patches/CVE-2019-13115.patch: add _libssh2_copy_string()\n       bounds-checked helper and use it in kex DH group exchange\n     - CVE-2019-13115","status":"published","published":"2026-04-22T13:31:52Z","modified":"2026-06-04T10:03:53.59233Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778159627","title":"libssh2: Fix of 2 CVEs","description":"- CVE-2019-13115: add bounds-checked string_buf helpers and use them in\n  diffie_hellman_sha1() to prevent out-of-bounds read on malformed KEX\n  reply\n- CVE-2019-17498: harden bounds checks in SSH_MSG_DISCONNECT,\n  SSH_MSG_DEBUG and SSH_MSG_GLOBAL_REQUEST handlers to prevent integer\n  overflow / out-of-bounds read","status":"published","published":"2026-05-08T11:40:09Z","modified":"2026-06-01T00:33:17.177826429Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-1730-3","title":"libssh2 - regression update","status":"published","published":"2019-07-25T00:00:00Z","modified":"2026-03-09T01:23:17.408499Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2848-1","title":"libssh2 - security update","status":"published","published":"2021-12-17T00:00:00Z","modified":"2026-03-09T01:21:50.913871Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3559-1","title":"libssh2 - security update","status":"published","published":"2023-09-08T00:00:00Z","modified":"2026-03-09T01:19:18.791703Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-5308-1","title":"libssh2 vulnerabilities","description":"It was discovered that libssh2 mishandled certain input. If libssh2 were\nused to connect to a malicious or compromised SSH server, a remote,\nunauthenticated attacker could possibly execute arbitrary code on the client \nsystem. (CVE-2019-3855)\n\nIt was discovered that libssh2 incorrectly handled prompt requests. A\nremote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2019-3856)\n\nIt was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST\npackets. A remote attacker could possibly use this issue to execute\narbitrary code, cause a denial of service, or obtain sensitive information. \n(CVE-2019-3857, CVE-2019-3862)\n\nIt was discovered that libssh2 incorrectly handled specially crafted SFTP\npackets. A remote attacker could possibly use this issue to cause a denial\nof service or obtain sensitive information. (CVE-2019-3858)\n\nIt was discovered that libssh2 incorrectly handled certain specially\ncrafted packets. A remote attacker could possibly use this issue to cause a\ndenial of service or obtain sensitive information. (CVE-2019-3859)\n\nIt was discovered that libssh2 incorrectly handled SFTP packets with empty\npayloads. A remote attacker could possibly use this issue to cause a denial\nof service or obtain sensitive information. (CVE-2019-3860)\n\nIt was discovered that libssh2 incorrectly handled padding values in SSH\npackets. A remote attacker could possibly use this issue to cause a denial\nof service or obtain sensitive information. (CVE-2019-3861)\n\nIt was discovered that libssh2 incorrectly handled interactive response\nmessages length. A remote attacker could possibly use this issue to execute\narbitrary code. (CVE-2019-3863)\n\nIt was discovered that libssh2 incorrectly handled the Diffie Hellman key\nexchange. A remote attacker could possibly use this issue to cause a denial\nof service or obtain sensitive information. (CVE-2019-13115)\n\nIt was discovered that libssh2 incorrectly handled bound checks in\nSSH_MSG_DISCONNECT. A remote attacker could possibly use this issue to\ncause a denial of service or obtain sensitive information. (CVE-2019-17498)\n","status":"published","published":"2022-03-07T23:47:01Z","modified":"2026-06-25T13:31:02.300768211Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}