CVE-2019-3862: Debian Linux

Critical severity, CVSS 9.1. EPSS: 7.9% chance of exploitation in the next 30 days.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 29 only
• LIBSSH2 LIBSSH2: before 1.8.1 (fixed in 1.8.1)
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Opensuse Leap: version 42.3 only

Published 2019-03-21. Last modified 2026-06-17.