CVE-2019-6486: Debian Linux

High severity, CVSS 8.2. EPSS: 4.3% chance of exploitation in the next 30 days.

Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Golang Go: before 1.10.8 (fixed in 1.10.8); from 1.11.1, before 1.11.5 (fixed in 1.11.5)
• Opensuse Leap: version 15.0 only

Published 2019-01-24. Last modified 2026-06-17.