CVE-2019-15134: Riot-OS Riot

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloop.c upon receiving an ACK before a SYN.

Affected products

• Riot-OS Riot: up to and including 2019.07

Published 2019-08-17. Last modified 2026-06-17.