Back to Database
Status published
Unknown
CVE-2019-5436
A heap buffer overflow in the TFTP receiving code allows...
Vulnerability Description
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-5436
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
- http://www.openwall.com/lists/oss-security/2019/09/11/6
- https://www.debian.org/security/2020/dsa-4633
- https://seclists.org/bugtraq/2020/Feb/36
- https://security.gentoo.org/glsa/202003-29
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20190606-0004/
- https://curl.haxx.se/docs/CVE-2019-5436.html
- https://support.f5.com/csp/article/K55133295
- https://support.f5.com/csp/article/K55133295?utm_source=f5support&%3Butm_medium=RSS
More from curl
View All →CVE-2025-9086
Out of bounds read for cookie path
Unknown
0
CVE-2025-5399
WebSocket endless loop
Unknown
0
CVE-2025-5025
No QUIC certificate pinning with wolfSSL
Unknown
0
CVE-2025-4947
QUIC certificate check skip with wolfSSL
Unknown
0
CVE-2025-15224
libssh key passphrase bypass without agent set
Unknown
0
Affected Vendor
curl
View all reports →Affected Software
curl
Vulnerable Versions:
Fixed in 7.65.0
Timeline
Official Publish:
May 28th, 2019
Last Modified:
April 15th, 2026
Added to House:
July 20th, 2026
CVSS Vectors
No vector data available