TI-2019-03845 Aliases CVE-2019-5436 GHSA-8xvc-p9x4-w7jm

Heap-based buffer overflow in curl

HIGH 67CWE-122Published 2019-05-28 · Updated 2026-10-14

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 13 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.49739 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 4 advisoriesRed Hat: 13 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
curl	curl	Fixed in 7.65.0	—	No fix listed	CNA

curl Vendorcurl Affected Fixed in 7.65.0 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:libcurl::::::::	7.19.4 – 7.64.1	Vulnerable	Haxx
cpe:2.3:o:opensuse:leap:15.0:::::::*	15.0	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:42.3:::::::*	42.3	Vulnerable	openSUSE
cpe:2.3:o:fedoraproject:fedora:29:::::::*	29	Vulnerable	Fedoraproject
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:a:f5:traffix_signaling_delivery_controller::::::::	5.0.0 – 5.1.0	Vulnerable	F5
cpe:2.3:a:netapp:hci_management_node:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:solidfire:-:::::::*	not specified by NVD	Vulnerable	NetApp

cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* Versions 7.19.4 – 7.64.1 Vulnerable ·Haxx
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.1.0 Vulnerable ·F5
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Show 5 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:::::::*	12.3.3	Vulnerable	Oracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:::::::*	12.4.0	Vulnerable	Oracle
cpe:2.3:a:oracle:mysql_server::::::::	up to 5.7.27; 5.7.28 – 8.0.17	Vulnerable	Oracle
cpe:2.3:a:oracle:oss_support_tools:20.0:::::::*	20.0	Vulnerable	Oracle

cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions up to 5.7.27; 5.7.28 – 8.0.17 Vulnerable ·Oracle
cpe:2.3:a:oracle:oss_support_tools:20.0:*:*:*:*:*:*:* Versions 20.0 Vulnerable ·Oracle

Remediation

Red Hat 4 advisories

RHSA-2020:2505 Released 2020-06-12 · Red Hat rating Low
curl security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) curl-7.29.0-54.el7_7.3, libcurl-7.29.0-54.el7_7.3
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) libcurl-devel-7.29.0-54.el7_7.3
- Red Hat Enterprise Linux Server EUS (v. 7.7) curl-7.29.0-54.el7_7.3, libcurl-7.29.0-54.el7_7.3, libcurl-7.29.0-54.el7_7.3.ppc +2
RHSA-2020:1792 Released 2020-04-28 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-12.el8, libcurl-7.61.1-12.el8, libcurl-devel-7.61.1-12.el8 +1
RHSA-2020:1020 Released 2020-03-31 · Red Hat rating Low
curl security and bug fix update
- Red Hat Enterprise Linux Client (v. 7) curl-7.29.0-57.el7, libcurl-7.29.0-57.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel-7.29.0-57.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) curl-7.29.0-57.el7, libcurl-7.29.0-57.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel-7.29.0-57.el7
- Red Hat Enterprise Linux Server (v. 7) curl-7.29.0-57.el7, libcurl-7.29.0-57.el7, libcurl-7.29.0-57.el7.ppc +2
- Red Hat Enterprise Linux Workstation (v. 7) curl-7.29.0-57.el7, libcurl-7.29.0-57.el7, libcurl-devel-7.29.0-57.el7

Show 1 more Red Hat advisories

RHSA-2019:1543 Released 2019-06-18 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update
- JBoss Core Services Apache HTTP Server 2.4.29 SP2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2019-05-28
curl — FEDORA-2019-697de0501f
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2019-03844 An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.Priority LOW 26
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat JBoss Core Services	Affected	No fix yet
Red Hat Software Collections	Affected	No fix yet: Fix deferred
JBoss Core Services Apache HTTP Server 2.4.29 SP2	Fixed	RHSA-2019:1543
Red Hat Ansible Tower 3.5 for RHEL 7 Server	Fixed	—
Red Hat Ansible Tower 3.6 for RHEL 7	Fixed	—
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2020:1792
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2020:1020
Red Hat Enterprise Linux Client Optional (v. 7)	Fixed	RHSA-2020:1020
Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2020:1020
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)	Fixed	RHSA-2020:2505
Red Hat Enterprise Linux ComputeNode Optional (v. 7)	Fixed	RHSA-2020:1020
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)	Fixed	RHSA-2020:2505
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2020:1020
Red Hat Enterprise Linux Server EUS (v. 7.7)	Fixed	RHSA-2020:2505
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2020:1020

Not affected: 6 products

.NET Core 1.0 on Red Hat Enterprise Linux
.NET Core 1.1 on Red Hat Enterprise Linux
.NET Core 2.1 on Red Hat Enterprise Linux
.NET Core 2.2 on Red Hat Enterprise Linux
Red Hat Enterprise Linux 5
Red Hat JBoss Web Server 5

Timeline

2026-10-02 Threatist record created from CVE-2019-5436
2026-10-03 Alias added: GHSA-8xvc-p9x4-w7jm

References

Exploit 1

https://curl.haxx.se/docs/CVE-2019-5436.html

Patch 2

Advisory 9

Other 2

TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8

See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences