CVE-2019-5597

In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of the first packet allowing maliciously crafted IPv6 packets to cause a crash or potentially bypass the packet filter.

• CWE-20

• http://packetstormsecurity.com/files/152933/FreeBSD-Security-Advisory-FreeBSD-SA-19-05.pf.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108395
• https://security.FreeBSD.org/advisories/FreeBSD-SA-19:05.pf.ascPatch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190611-0001/
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdfExploit, Third Party Advisory
• http://packetstormsecurity.com/files/152933/FreeBSD-Security-Advisory-FreeBSD-SA-19-05.pf.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108395
• https://security.FreeBSD.org/advisories/FreeBSD-SA-19:05.pf.ascPatch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190611-0001/
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdfExploit, Third Party Advisory

Published

May 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5591A Default Configuration vulnerability in FortiOS may allow a…6.5
• CVE-2019-5592Multiple padding oracle vulnerabilities (Zombie POODLE, GOLD…5.9
• CVE-2019-5593Improper permission or value checking in the CLI console may…5.5
• CVE-2019-5594An Improper Neutralization of Input During Web Page Generati…
• CVE-2019-5595In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.…
• CVE-2019-5596In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.…
• CVE-2019-5598In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE befor…
• CVE-2019-5599In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE befor…
• CVE-2019-5600In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 1…
• CVE-2019-5601In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 1…
• CVE-2019-5602In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 1…
• CVE-2019-5603In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 1…7.8