CVE-2019-5482
criticalHeap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
Vendor / product: Haxx — curl
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-09-16 19:15
Modified: 2026-10-14 07:16
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
haxx / curl ≥7.19.4 ≤7.65.3
fedoraproject / fedora 29, 30, 31
opensuse / leap 15.0, 15.1
netapp / cloud_backup all versions
netapp / oncommand_insight all versions
netapp / oncommand_unified_manager ≥7.3, ≥9.5
netapp / oncommand_workflow_automation all versions
netapp / snapcenter all versions
netapp / steelstore_cloud_integrated_storage all versions
oracle / communications_operations_monitor 3.4, 4.0, 4.1, 4.2, 4.3
oracle / communications_session_border_controller 8.3, 8.4
oracle / enterprise_manager_ops_center 12.3.3, 12.4.0
oracle / http_server 12.2.1.3.0, 12.2.1.4.0
oracle / hyperion_essbase 11.1.2.4
oracle / mysql_server ≥5.0.0 ≤5.7.28, ≥8.0.0 ≤8.0.18
oracle / oss_support_tools 20.0
debian / debian_linux 9.0, 10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://curl.haxx.se/docs/CVE-2019-5482.html
Vendor advisory: https://curl.haxx.se/docs/CVE-2019-5482.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2020.html
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html support@hackerone.com
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html support@hackerone.com
- https://curl.haxx.se/docs/CVE-2019-5482.html support@hackerone.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... support@hackerone.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... support@hackerone.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... support@hackerone.com
- https://seclists.org/bugtraq/2020/Feb/36 support@hackerone.com
- https://security.gentoo.org/glsa/202003-29 support@hackerone.com
- https://security.netapp.com/advisory/ntap-20191004-0003/ support@hackerone.com
- https://security.netapp.com/advisory/ntap-20200416-0003/ support@hackerone.com
- https://www.debian.org/security/2020/dsa-4633 support@hackerone.com
- https://www.oracle.com/security-alerts/cpuapr2020.html support@hackerone.com
- https://www.oracle.com/security-alerts/cpujan2020.html support@hackerone.com
- https://www.oracle.com/security-alerts/cpuoct2020.html support@hackerone.com
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html af854a3a-2127-422b-91ae-364da2661108
- https://curl.haxx.se/docs/CVE-2019-5482.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://seclists.org/bugtraq/2020/Feb/36 af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/202003-29 af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20191004-0003/ af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20200416-0003/ af854a3a-2127-422b-91ae-364da2661108
- https://www.debian.org/security/2020/dsa-4633 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗