$ cve CVE-2019-18805 JSON

CVE-2019-18805

9.8

CRITICAL · CVSS 3.1 · EPSS 3.4% (pctl 89)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	3.43% — more likely to be exploited than 89% of all CVEs
Weakness	CWE-190
On CISA KEV	no
Public exploit	none known
Published	2019-11-07
Last modified	2026-06-17

Affected (22)

Vendor	Product
broadcom	fabric operating system
linux	linux kernel
netapp	active iq unified manager
netapp	aff a400
netapp	aff a400 firmware
netapp	aff a700s
netapp	aff a700s firmware
netapp	data availability services
netapp	e-series santricity os controller
netapp	fas8300
netapp	fas8300 firmware
netapp	fas8700
netapp	fas8700 firmware
netapp	h610s
netapp	h610s firmware
netapp	hci compute node
netapp	hci management node
netapp	hci storage node
netapp	solidfire
netapp	steelstore cloud integrated storage
opensuse	leap
redhat	enterprise linux

References

→ the Explorer · watch your stack · NVD