CVE-2019-10013

The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted certificate in the TLS certificate handshake message, because the result of get_asn1_length() is not checked for a minimum or maximum size.

• CWE-120

• http://axtls.sourceforge.netVendor Advisory
• http://packetstormsecurity.com/files/155500/axTLS-2.1.5-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Nov/44
• https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842
• https://www.telekom.com/resource/blob/586416/12097aeb8f9a6bba89a804b94575521a/dl-191121-critical-remote-denial-of-service-vulnerability-i--data.pdf
• http://axtls.sourceforge.netVendor Advisory
• http://packetstormsecurity.com/files/155500/axTLS-2.1.5-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Nov/44
• https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842
• https://www.telekom.com/resource/blob/586416/12097aeb8f9a6bba89a804b94575521a/dl-191121-critical-remote-denial-of-service-vulnerability-i--data.pdf

Published

Dec 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10008Zoho ManageEngine ServiceDesk 9.3 allows session hijacking a…
• CVE-2019-10009A Directory Traversal issue was discovered in the Web GUI in…
• CVE-2019-1001A remote code execution vulnerability exists in the way the …
• CVE-2019-10010Cross-site scripting (XSS) vulnerability in the PHP League C…
• CVE-2019-10011ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Inte…
• CVE-2019-10012Jenzabar JICS (aka Internet Campus Solution) before 9 allows…7.5
• CVE-2019-10014In DedeCMS 5.7SP2, member/resetpassword.php allows remote au…
• CVE-2019-10015baigoStudio baigoSSO v3.0.1 allows remote attackers to execu…
• CVE-2019-10016GForge Advanced Server 6.4.4 allows XSS via the commonsearch…
• CVE-2019-10017CMS Made Simple 2.2.10 has XSS via the moduleinterface.php N…
• CVE-2019-10018An issue was discovered in Xpdf 4.01.01. There is an FPE in …5.5
• CVE-2019-10019An issue was discovered in Xpdf 4.01.01. There is an FPE in …