--- id: CVE-2019-17498 title: >- In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read summary: >- In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH s… severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H' cwe: - CWE-190 vendor: libssh2 product: libssh2 affected: - libssh2 <= 1.9.0 - fedora = 30 - fedora = 31 - leap = 15.1 - debian_linux = 8.0 - debian_linux = 9.0 - active_iq_unified_manager - element_software - hci_management_node - ontap_select_deploy_administration_utility - solidfire - bootstrap_os published: '2019-10-21' updated: '2026-10-14' sourceUpdated: '2026-10-14T07:16:48.780' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-17498' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html' label: cve@mitre.org - url: >- http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html label: cve@mitre.org - url: 'https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/' label: cve@mitre.org - url: >- https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498 label: cve@mitre.org - url: >- https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480 label: cve@mitre.org - url: >- https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/ label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20220909-0004/' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20220909-0004/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-17498.json - url: 'https://access.redhat.com/security/cve/CVE-2019-17498' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1766898' - url: 'https://www.cve.org/CVERecord?id=CVE-2019-17498' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-17498' - url: 'https://access.redhat.com/errata/RHSA-2020:3915' - url: 'https://access.redhat.com/errata/RHSA-2021:0949' tags: - nvd - exploit-available - csaf - vex - red-hat epss: 0.03762 epssPercentile: 0.89678 exploits: github: 1 githubRepos: - 'https://github.com/Timon-L/3007Project' checkedAt: '2026-10-14T07:21:40.625Z' exploitAvailable: true ingestedAt: '2026-10-14T07:21:04.822Z' patched: - enterprise_linux_client_v_7 - enterprise_linux_client_optional_v_7 - enterprise_linux_computenode_v_7 - enterprise_linux_computenode_optional_v_7 - enterprise_linux_server_v_7 - openshift_do 1 - enterprise_linux_server_optional_v_7 - enterprise_linux_workstation_v_7 - enterprise_linux_workstation_optional_v_7 scores: nvd: 8.1 vendor: 6.5 --- ## Overview In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. ## Affected - `libssh2 <= 1.9.0` - `fedora = 30` - `fedora = 31` - `leap = 15.1` - `debian_linux = 8.0` - `debian_linux = 9.0` - `active_iq_unified_manager` - `element_software` - `hci_management_node` - `ontap_select_deploy_administration_utility` - `solidfire` - `bootstrap_os` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2020:3915** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2020:3915) - **RHSA-2021:0949** · Red Hat · fixed in: OpenShift Do 1 · released 2021-03-22 · [advisory](https://access.redhat.com/errata/RHSA-2021:0949) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 Advanced Virtualization · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 Advanced Virtualization · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-17498.json)