{"id":"CVE-2019-8460","aliases":["EUVD-2019-17850","GHSA-9q38-5hh6-p5gw"],"status":"published","title":"Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that...","description":"OpenBSD kernel version \u003c= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02253,"percentile":0.83039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1049"],"published":"2019-08-26T19:18:49Z","modified":"2026-06-17T02:42:02Z","products":[{"vendor":"openbsd","product":"openbsd"}],"references":[{"url":"https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190905-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460/","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Press/Media Coverage","Third Party Advisory"]},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8460"},{"url":"https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460"},{"url":"https://security.netapp.com/advisory/ntap-20190905-0001"},{"url":"https://github.com/advisories/GHSA-9q38-5hh6-p5gw"}],"sources":{"cve":[{"id":"CVE-2019-8460","description":"OpenBSD kernel version \u003c= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.","status":"published","published":"2019-08-26T19:18:49Z","modified":"2024-08-04T21:17:31.425Z","cwes":["CWE-1049"],"updated_at":"2026-11-02T14:20:21.703364Z"}],"euvd":[{"id":"EUVD-2019-17850","description":"OpenBSD kernel version \u003c= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.","status":"published","published":"2019-08-26T19:18:49Z","modified":"2024-08-04T21:17:31Z","updated_at":"2026-11-03T03:06:42.550766Z"}],"ghsa":[{"id":"GHSA-9q38-5hh6-p5gw","title":"Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that...","description":"Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that OpenBSD kernel (all versions, including 6.5) can be forced to create long chains of TCP SACK holes that cause very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.","status":"published","published":"2022-05-24T16:54:52Z","modified":"2024-04-04T01:48:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1049"],"updated_at":"2026-11-02T14:56:02.808081Z"}],"nvd":[{"id":"CVE-2019-8460","description":"OpenBSD kernel version \u003c= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.","status":"published","published":"2019-08-26T20:15:10.03Z","modified":"2026-06-17T02:42:02.263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1049"],"updated_at":"2026-11-02T14:05:23.725587Z"}]}}