CVE-2019-3859: Debian Linux

Critical severity, CVSS 9.1. EPSS: 6.3% chance of exploitation in the next 30 days.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 28 only; version 29 only
• LIBSSH2 LIBSSH2: before 1.8.1 (fixed in 1.8.1)
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Opensuse Leap: version 15.0 only; version 42.3 only

Published 2019-03-21. Last modified 2026-06-17.