--- id: CVE-2019-3863 title: >- A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side summary: >- A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value … severity: high cvss: 7.5 cvssVector: 'CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-190 - CWE-787 vendor: libssh2 product: libssh2 affected: - libssh2 < 1.8.1 - debian_linux = 8.0 - ontap_select_deploy_administration_utility - leap = 15.0 - leap = 42.3 - enterprise_linux_desktop = 7.0 - enterprise_linux_server = 7.0 - enterprise_linux_server_aus = 7.6 - enterprise_linux_server_eus = 7.6 - enterprise_linux_server_tus = 7.6 - enterprise_linux_workstation = 7.0 patched: - libssh2 1.8.1 published: '2019-03-25' updated: '2026-10-14' sourceUpdated: '2026-10-14T07:16:53.397' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-3863' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:0679' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:1175' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:1652' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:1791' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:1943' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:2399' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863' label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html' label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ label: secalert@redhat.com - url: 'https://seclists.org/bugtraq/2019/Apr/25' label: secalert@redhat.com - url: 'https://security.netapp.com/advisory/ntap-20190327-0005/' label: secalert@redhat.com - url: 'https://www.debian.org/security/2019/dsa-4431' label: secalert@redhat.com - url: 'https://www.libssh2.org/CVE-2019-3863.html' label: secalert@redhat.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0679' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1175' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1652' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1791' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1943' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2399' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Apr/25' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190327-0005/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2019/dsa-4431' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.libssh2.org/CVE-2019-3863.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-3863.json - url: 'https://access.redhat.com/security/cve/CVE-2019-3863' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1687313' - url: 'https://www.cve.org/CVERecord?id=CVE-2019-3863' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-3863' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.03437 epssPercentile: 0.889 ingestedAt: '2026-10-14T07:21:04.811Z' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2025-04-23T13:20:45.609039Z' --- ## Overview A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error. ## Affected - `libssh2 < 1.8.1` - `debian_linux = 8.0` - `ontap_select_deploy_administration_utility` - `leap = 15.0` - `leap = 42.3` - `enterprise_linux_desktop = 7.0` - `enterprise_linux_server = 7.0` - `enterprise_linux_server_aus = 7.6` - `enterprise_linux_server_eus = 7.6` - `enterprise_linux_server_tus = 7.6` - `enterprise_linux_workstation = 7.0` ## Remediation Upgrade past the affected range: - `libssh2 1.8.1` ## Vendor advisories - **RHSA-2019:1652** · Red Hat · fixed in: Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux Desktop Optional (v. 6), Red Hat Enterprise Linux HPC Node (v. 6), Red Hat Enterprise Linux HPC Node Optional (v. 6), Red Hat Enterprise Linux Server (v. 6), Red Hat Enterprise Linux Server Optional (v. 6), … · released 2019-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2019:1652) - **RHSA-2019:0679** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7), … · released 2019-03-28 · [advisory](https://access.redhat.com/errata/RHSA-2019:0679) - **RHSA-2019:1943** · Red Hat · fixed in: Red Hat Enterprise Linux ComputeNode EUS (v. 7.4), Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4), Red Hat Enterprise Linux Server EUS (v. 7.4), Red Hat Enterprise Linux Server Optional EUS (v. 7.4) · released 2019-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2019:1943) - **RHSA-2019:1791** · Red Hat · fixed in: Red Hat Enterprise Linux ComputeNode EUS (v. 7.5), Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5), Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Enterprise Linux Server Optional EUS (v. 7.5) · released 2019-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2019:1791) - **RHSA-2019:2399** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.3), Red Hat Enterprise Linux Server E4S (v. 7.3), Red Hat Enterprise Linux Server TUS (v. 7.3), Red Hat Enterprise Linux Server Optional AUS (v. 7.3), Red Hat Enterprise Linux Server Optional E4S (v. 7.3), Red Hat Enterprise Linux Server Optional TUS (v. 7.3) · released 2019-08-07 · [advisory](https://access.redhat.com/errata/RHSA-2019:2399) - **RHSA-2019:1175** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2019-05-14 · [advisory](https://access.redhat.com/errata/RHSA-2019:1175) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Virtualization 4 · no fix planned: Red Hat Virtualization 4, Red Hat Enterprise Linux 8 Advanced Virtualization · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-3863.json)