{"id":"CVE-2019-19906","title":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet","summary":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-193","CWE-787","CWE-400"],"vendor":"cyrusimap","product":"cyrus-sasl","affected":["cyrus-sasl < 2.1.28","debian_linux = 8.0","debian_linux = 9.0","debian_linux = 10.0","ubuntu_linux = 12.04","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 19.10","fedora = 31","fedora = 32","jboss_enterprise_web_server = 2.0.0","mac_os_x = 10.14.6","enterprise_linux = 5.0","enterprise_linux = 6.0","enterprise_linux = 7.0","enterprise_linux = 8.0","enterprise_linux_eus = 8.4","enterprise_linux_for_ibm_z_systems = 8.0","enterprise_linux_for_ibm_z_systems_eus = 8.4","enterprise_linux_for_power_little_endian = 8.0","enterprise_linux_for_power_little_endian_eus = 8.4","enterprise_linux_server_aus = 8.4","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.4","enterprise_linux_server_tus = 8.4","enterprise_linux_server_update_services_for_sap_solutions = 8.4","ipados = 13.6","iphone_os = 13.6","mac_os_x < 10.13.6","mac_os_x >= 10.13.0, < 10.13.6","mac_os_x >= 10.15.0, < 10.15.6","mac_os_x = 10.13.6","bookkeeper = 4.12.1"],"patched":["cyrus-sasl 2.1.28","mac_os_x 10.15.6"],"published":"2019-12-19","updated":"2026-10-14","sourceUpdated":"2026-10-14T08:16:59.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","references":[{"url":"http://seclists.org/fulldisclosure/2020/Jul/23","label":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2020/Jul/24","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2022/02/23/4","label":"cve@mitre.org"},{"url":"https://github.com/cyrusimap/cyrus-sasl/issues/587","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","label":"cve@mitre.org"},{"url":"https://seclists.org/bugtraq/2019/Dec/42","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT211288","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT211289","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4256-1/","label":"cve@mitre.org"},{"url":"https://www.debian.org/security/2019/dsa-4591","label":"cve@mitre.org"},{"url":"https://www.openldap.org/its/index.cgi/Incoming?id=9123","label":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2020/Jul/23","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2020/Jul/24","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2022/02/23/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/cyrusimap/cyrus-sasl/issues/587","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Dec/42","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT211288","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT211289","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4256-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4591","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openldap.org/its/index.cgi/Incoming?id=9123","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-19906.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-19906"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791854"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19906"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906"},{"url":"https://access.redhat.com/errata/RHSA-2020:4497"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.08036,"epssPercentile":0.94676,"ingestedAt":"2026-10-14T08:23:04.326Z","slug":"CVE-2019-19906","body":"## Overview\n\ncyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.\n\n## Affected\n\n- `cyrus-sasl < 2.1.28`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `debian_linux = 10.0`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 19.10`\n- `fedora = 31`\n- `fedora = 32`\n- `jboss_enterprise_web_server = 2.0.0`\n- `mac_os_x = 10.14.6`\n- `enterprise_linux = 5.0`\n- `enterprise_linux = 6.0`\n- `enterprise_linux = 7.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux_eus = 8.4`\n- `enterprise_linux_for_ibm_z_systems = 8.0`\n- `enterprise_linux_for_ibm_z_systems_eus = 8.4`\n- `enterprise_linux_for_power_little_endian = 8.0`\n- `enterprise_linux_for_power_little_endian_eus = 8.4`\n- `enterprise_linux_server_aus = 8.4`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.4`\n- `enterprise_linux_server_tus = 8.4`\n- `enterprise_linux_server_update_services_for_sap_solutions = 8.4`\n- `ipados = 13.6`\n- `iphone_os = 13.6`\n- `mac_os_x < 10.13.6`\n- `mac_os_x >= 10.13.0, < 10.13.6`\n- `mac_os_x >= 10.15.0, < 10.15.6`\n- `mac_os_x = 10.13.6`\n- `bookkeeper = 4.12.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cyrus-sasl 2.1.28`\n- `mac_os_x 10.15.6`\n\n## Vendor advisories\n\n- **RHSA-2020:4497** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2020:4497)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat JBoss Enterprise Web Server 2 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat JBoss Enterprise Web Server 2, Red Hat Enterprise Linux 7 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-19906.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":41.3,"likelihood":1.6,"exploitation":0,"ransomware":0},"changes":[]}