CVE-2019-3860: Debian Linux

Critical severity, CVSS 9.1. EPSS: 5.1% chance of exploitation in the next 30 days.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Affected products

• Debian Debian Linux: version 8.0 only
• LIBSSH2 LIBSSH2: from 0.3, up to and including 1.8.0
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Opensuse Leap: version 15.0 only; version 42.3 only

Published 2019-03-25. Last modified 2026-06-17.