TI-2019-03890 Aliases CVE-2019-5482 GHSA-35cc-32cj-vr6g

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

HIGH 66CWE-122Published 2019-09-16 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 20 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.17939 97th percentileScored 2026-11-07

Fix Partial Red Hat: 7 advisoriesRed Hat: 20 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	curl	7.19.4 to 7.65.3	—	No fix listed	CNA

curl Vendor— Affected 7.19.4 to 7.65.3 Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:curl::::::::	7.19.4 – 7.65.3	Vulnerable	Haxx
cpe:2.3:o:fedoraproject:fedora:29:::::::*	29	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:30:::::::*	30	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:::::::*	31	Vulnerable	Fedoraproject
cpe:2.3:o:opensuse:leap:15.0:::::::*	15.0	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE
cpe:2.3:a:netapp:cloud_backup:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:oncommand_insight:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:oncommand_unified_manager::::::windows::*	7.3	Vulnerable	NetApp
cpe:2.3:a:netapp:oncommand_unified_manager::::::vmware_vsphere::*	9.5	Vulnerable	NetApp

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.19.4 – 7.65.3 Vulnerable ·Haxx
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp

Show 19 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:snapcenter:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:oracle:communications_operations_monitor:3.4:::::::*	3.4	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.0:::::::*	4.0	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.1:::::::*	4.1	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.2:::::::*	4.2	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.3:::::::*	4.3	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_session_border_controller:8.3:::::::*	8.3	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_session_border_controller:8.4:::::::*	8.4	Vulnerable	Oracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:::::::*	12.3.3	Vulnerable	Oracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:::::::*	12.4.0	Vulnerable	Oracle
cpe:2.3:a:oracle:http_server:12.2.1.3.0:::::::*	12.2.1.3.0	Vulnerable	Oracle
cpe:2.3:a:oracle:http_server:12.2.1.4.0:::::::*	12.2.1.4.0	Vulnerable	Oracle
cpe:2.3:a:oracle:hyperion_essbase:11.1.2.4:::::::*	11.1.2.4	Vulnerable	Oracle
cpe:2.3:a:oracle:mysql_server::::::::	5.0.0 – 5.7.28; 8.0.0 – 8.0.18	Vulnerable	Oracle
cpe:2.3:a:oracle:oss_support_tools:20.0:::::::*	20.0	Vulnerable	Oracle
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_session_border_controller:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:hyperion_essbase:11.1.2.4:*:*:*:*:*:*:* Versions 11.1.2.4 Vulnerable ·Oracle
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.7.28; 8.0.0 – 8.0.18 Vulnerable ·Oracle
cpe:2.3:a:oracle:oss_support_tools:20.0:*:*:*:*:*:*:* Versions 20.0 Vulnerable ·Oracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Red Hat 7 advisories

RHSA-2021:1027 Released 2021-03-30 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) curl-7.29.0-54.el7_7.4, libcurl-7.29.0-54.el7_7.4
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) libcurl-devel-7.29.0-54.el7_7.4
- Red Hat Enterprise Linux Server EUS (v. 7.7) curl-7.29.0-54.el7_7.4, libcurl-7.29.0-54.el7_7.4, libcurl-7.29.0-54.el7_7.4.ppc +2
RHSA-2021:0949 Released 2021-03-22 · Red Hat rating Low
Red Hat OpenShift Do openshift/odo-init-image 1.1.3 security update
- OpenShift Do 1 openshiftdo/odo-init-image-rhel7
RHSA-2021:0877 Released 2021-03-16 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) curl-7.29.0-51.el7_6.4, libcurl-7.29.0-51.el7_6.4
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) libcurl-devel-7.29.0-51.el7_6.4
- Red Hat Enterprise Linux Server EUS (v. 7.6) curl-7.29.0-51.el7_6.4, libcurl-7.29.0-51.el7_6.4, libcurl-7.29.0-51.el7_6.4.ppc +2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) curl-7.29.0-51.el7_6.4, libcurl-7.29.0-51.el7_6.4, libcurl-devel-7.29.0-51.el7_6.4

Show 4 more Red Hat advisories

RHSA-2021:0759 Released 2021-03-09 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux Server AUS (v. 7.4) curl-7.29.0-42.el7_4.3, libcurl-7.29.0-42.el7_4.3, libcurl-devel-7.29.0-42.el7_4.3
- Red Hat Enterprise Linux Server E4S (v. 7.4) curl-7.29.0-42.el7_4.3, libcurl-7.29.0-42.el7_4.3, libcurl-devel-7.29.0-42.el7_4.3
- Red Hat Enterprise Linux Server TUS (v. 7.4) curl-7.29.0-42.el7_4.3, libcurl-7.29.0-42.el7_4.3, libcurl-devel-7.29.0-42.el7_4.3
RHSA-2020:3916 Released 2020-09-29 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux Client (v. 7) curl-7.29.0-59.el7, libcurl-7.29.0-59.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel-7.29.0-59.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) curl-7.29.0-59.el7, libcurl-7.29.0-59.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel-7.29.0-59.el7
- Red Hat Enterprise Linux Server (v. 7) curl-7.29.0-59.el7, libcurl-7.29.0-59.el7, libcurl-7.29.0-59.el7.ppc +2
- Red Hat Enterprise Linux Workstation (v. 7) curl-7.29.0-59.el7, libcurl-7.29.0-59.el7, libcurl-devel-7.29.0-59.el7
RHSA-2020:1792 Released 2020-04-28 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-12.el8, libcurl-7.61.1-12.el8, libcurl-devel-7.61.1-12.el8 +1
RHSA-2020:0250 Released 2020-01-27 · Red Hat rating Low
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP1 Security Update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-73.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-73.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-54.jbcs.el6 +38
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-73.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-73.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-54.jbcs.el7 +38

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2019-09-16
curl — openSUSE-SU-2019:2149
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03889 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.Priority MEDIUM 59
Show all 2 records → Advisory →
Advisory · 2019-09-16
curl — openSUSE-SU-2019:2169
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03889 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.Priority MEDIUM 59
Show all 2 records → Advisory →

Show 3 more groups

Advisory · 2019-09-16
curl — FEDORA-2019-f2a520135e
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03889 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.Priority MEDIUM 59
Show all 2 records → Advisory →
Advisory · 2019-09-16
curl — FEDORA-2019-9e6357d82f
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03889 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.Priority MEDIUM 59
Show all 2 records → Advisory →
Advisory · 2019-09-16
curl — FEDORA-2019-6d7f6fa2c8
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03889 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.Priority MEDIUM 59
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Software Collections	Affected	No fix planned: Will not fix
OpenShift Do 1	Fixed	RHSA-2021:0949
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2020:1792
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2020:3916
Red Hat Enterprise Linux Client Optional (v. 7)	Fixed	RHSA-2020:3916
Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2020:3916
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)	Fixed	RHSA-2021:0877
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)	Fixed	RHSA-2021:1027
Red Hat Enterprise Linux ComputeNode Optional (v. 7)	Fixed	RHSA-2020:3916
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)	Fixed	RHSA-2021:0877
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)	Fixed	RHSA-2021:1027
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2020:3916
Red Hat Enterprise Linux Server AUS (v. 7.4)	Fixed	RHSA-2021:0759
Red Hat Enterprise Linux Server E4S (v. 7.4)	Fixed	RHSA-2021:0759
Red Hat Enterprise Linux Server EUS (v. 7.6)	Fixed	RHSA-2021:0877
Red Hat Enterprise Linux Server EUS (v. 7.7)	Fixed	RHSA-2021:1027
Red Hat Enterprise Linux Server TUS (v. 7.4)	Fixed	RHSA-2021:0759
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2020:3916
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)	Fixed	RHSA-2021:0877
Red Hat JBoss Core Services on RHEL 6 Server	Fixed	RHSA-2020:0250
Red Hat JBoss Core Services on RHEL 7 Server	Fixed	RHSA-2020:0250

Not affected: 4 products

.NET Core 2.1 on Red Hat Enterprise Linux
.NET Core 2.2 on Red Hat Enterprise Linux
Red Hat Enterprise Linux 5
Red Hat JBoss Web Server 5

Timeline

2026-10-02 Threatist record created from CVE-2019-5482
2026-10-03 Alias added: GHSA-35cc-32cj-vr6g

References

Patch 3

Advisory 11

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

Key facts

Summary

Why it matters now

SSVC decision points

Affected products

CPE configurations NVD · 29

Remediation

Red Hat 7 advisories

Fixed in the same release

curl — openSUSE-SU-2019:2149

curl — openSUSE-SU-2019:2169

curl — FEDORA-2019-f2a520135e

curl — FEDORA-2019-9e6357d82f

curl — FEDORA-2019-6d7f6fa2c8

Vendor assessments

Red Hat

Timeline

References

Patch 3

Advisory 11

Sources