CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

• CWE-122
• CWE-787

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/09/11/6Mailing List, Patch, Third Party Advisory
• https://curl.haxx.se/docs/CVE-2019-5436.htmlExploit, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
• https://seclists.org/bugtraq/2020/Feb/36Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-29Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190606-0004/Third Party Advisory
• https://support.f5.com/csp/article/K55133295Third Party Advisory
• https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS
• https://www.debian.org/security/2020/dsa-4633Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/09/11/6Mailing List, Patch, Third Party Advisory
• https://curl.haxx.se/docs/CVE-2019-5436.htmlExploit, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
• https://seclists.org/bugtraq/2020/Feb/36Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-29Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190606-0004/Third Party Advisory
• https://support.f5.com/csp/article/K55133295Third Party Advisory
• https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS
• https://www.debian.org/security/2020/dsa-4633Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatch, Third Party Advisory

Published

May 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5430In UniFi Video 3.10.0 and prior, due to the lack of CSRF pro…
• CVE-2019-5431This vulnerability was caused by an incomplete fix to CVE-20…5.4
• CVE-2019-5432A specifically malformed MQTT Subscribe packet crashes MQTT …7.5
• CVE-2019-5433A user having access to the UI of a Revive Adserver instance…
• CVE-2019-5434An attacker could send a specifically crafted payload to the…
• CVE-2019-5435An integer overflow in curl's URL API results in a buffer ov…
• CVE-2019-5437Information exposure through the directory listing in npm's …
• CVE-2019-5438Path traversal using symlink in npm harp module versions <= …5.3
• CVE-2019-5439A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash…
• CVE-2019-5440Use of cryptographically weak PRNG in the password recovery …
• CVE-2019-5441Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5442XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0…7.5