CVE-2019-3994: Elog Project Elog

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieve_url() to use a freed variable.

Affected products

• Elog Project Elog: up to and including 3.1.4-57bea22
• Fedoraproject Fedora: version 30 only; version 31 only

Published 2019-12-17. Last modified 2026-06-17.