Back to Database
Status published
High
CVE-2019-3863
A flaw was found in libssh2 before 1.8.1 creating a...
Vulnerability Description
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-3863
Credits & Attribution
No credits recorded in the NVD database.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863
- https://www.libssh2.org/CVE-2019-3863.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html
- https://security.netapp.com/advisory/ntap-20190327-0005/
- https://access.redhat.com/errata/RHSA-2019:0679
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/
- https://www.debian.org/security/2019/dsa-4431
- https://seclists.org/bugtraq/2019/Apr/25
- https://access.redhat.com/errata/RHSA-2019:1175
- https://access.redhat.com/errata/RHSA-2019:1652
- https://access.redhat.com/errata/RHSA-2019:1791
- https://access.redhat.com/errata/RHSA-2019:1943
- https://access.redhat.com/errata/RHSA-2019:2399
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
More from The libssh2 Project
View All →CVE-2019-3862
An out of bounds read flaw was discovered in libssh2...
High
7.3
CVE-2019-3861
An out of bounds read flaw was discovered in libssh2...
Medium
5
CVE-2019-3860
An out of bounds read flaw was discovered in libssh2...
Medium
5
CVE-2019-3859
An out of bounds read flaw was discovered in libssh2...
Medium
5
CVE-2019-3858
An out of bounds read flaw was discovered in libssh2...
Medium
5
Affected Vendor
The libssh2 Project
View all reports →Affected Software
libssh2
Vulnerable Versions:
1.8.1
Timeline
Official Publish:
March 25th, 2019
Last Modified:
December 19th, 2025
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H