TI-2019-15952 Aliases CVE-2019-1010017 GHSA-9ccv-p7fg-m73x

XML injection in libnmap

LOW 36CWE-91Published 2019-07-15 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.

Why it matters now

EPSS 0.01524 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed libnmap (libnmap): v0.6.3python-libnmap (PyPI): 0.7.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
libnmap	libnmap	before v0.6.3	v0.6.3	Patch available	CNA
—	python-libnmap (PyPI)	before 0.7.2	0.7.2	Patch available	GHSA-9ccv-p7fg-m73x

libnmap Vendorlibnmap Affected before v0.6.3 Fixed in v0.6.3 Patch available CNA
python-libnmap (PyPI) Vendor— Affected before 0.7.2 Fixed in 0.7.2 Patch available GHSA-9ccv-p7fg-m73x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:libnmap:libnmap::::::::	before 0.6.3	Vulnerable	libnmap

cpe:2.3:a:libnmap:libnmap:*:*:*:*:*:*:*:* Versions before 0.6.3 Vulnerable ·libnmap

Remediation

Fix · CNA libnmap (libnmap) Fixed in v0.6.3
Fix · GHSA-9ccv-p7fg-m73x python-libnmap (PyPI) Fixed in 0.7.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-1010017
2026-10-03 Alias added: GHSA-9ccv-p7fg-m73x

References

Exploit 1

https://github.com/savon-noir/python-libnmap/issues/87

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2019-1010017

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences