peter bassill · operator
$ cve CVE-2019-11500 JSON

CVE-2019-11500

9.8
CRITICAL · CVSS 3.0 · EPSS 62.6% (pctl 99)

Patch early

EPSS 62.6% — above the 10% action threshold.

Description

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.

Scoring

CVSS9.8 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS62.58% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-787
On CISA KEVno
Public exploitnone known
Published2019-08-29
Last modified2026-06-17

Affected (4)

VendorProduct
debiandebian linux
dovecotdovecot
dovecotpigeonhole
fedoraprojectfedora

References

→ the Explorer  ·  watch your stack  ·  NVD