{"id":"CVE-2019-17498","title":"In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read","summary":"In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH s…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":["CWE-190"],"vendor":"libssh2","product":"libssh2","affected":["libssh2 <= 1.9.0","fedora = 30","fedora = 31","leap = 15.1","debian_linux = 8.0","debian_linux = 9.0","active_iq_unified_manager","element_software","hci_management_node","ontap_select_deploy_administration_utility","solidfire","bootstrap_os"],"published":"2019-10-21","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:48.780","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-17498","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html","label":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html","label":"cve@mitre.org"},{"url":"https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/","label":"cve@mitre.org"},{"url":"https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498","label":"cve@mitre.org"},{"url":"https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480","label":"cve@mitre.org"},{"url":"https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20220909-0004/","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220909-0004/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-17498.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-17498"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766898"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17498"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17498"},{"url":"https://access.redhat.com/errata/RHSA-2020:3915"},{"url":"https://access.redhat.com/errata/RHSA-2021:0949"}],"tags":["nvd","exploit-available","csaf","vex","red-hat"],"epss":0.03762,"epssPercentile":0.89678,"exploits":{"github":1,"githubRepos":["https://github.com/Timon-L/3007Project"],"checkedAt":"2026-10-14T07:21:40.625Z"},"exploitAvailable":true,"ingestedAt":"2026-10-14T07:21:04.822Z","patched":["enterprise_linux_client_v_7","enterprise_linux_client_optional_v_7","enterprise_linux_computenode_v_7","enterprise_linux_computenode_optional_v_7","enterprise_linux_server_v_7","openshift_do 1","enterprise_linux_server_optional_v_7","enterprise_linux_workstation_v_7","enterprise_linux_workstation_optional_v_7"],"scores":{"nvd":8.1,"vendor":6.5},"slug":"CVE-2019-17498","body":"## Overview\n\nIn libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.\n\n## Affected\n\n- `libssh2 <= 1.9.0`\n- `fedora = 30`\n- `fedora = 31`\n- `leap = 15.1`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `active_iq_unified_manager`\n- `element_software`\n- `hci_management_node`\n- `ontap_select_deploy_administration_utility`\n- `solidfire`\n- `bootstrap_os`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2020:3915** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2020:3915)\n- **RHSA-2021:0949** · Red Hat · fixed in: OpenShift Do 1 · released 2021-03-22 · [advisory](https://access.redhat.com/errata/RHSA-2021:0949)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 Advanced Virtualization · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 Advanced Virtualization · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-17498.json)","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.8,"exploitation":12,"ransomware":0},"changes":[]}