Medium
Security advisory
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-9917
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:37 UTC · Revision 1
Source evidence
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
osv:CVE-2019-9917
Complete source record
{
"id": "e040e201502c250fbb990685f8fa4b93b7e85e0e39d02180fc2631382b1b6842",
"url": "https://osv.dev/vulnerability/CVE-2019-9917",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-9917",
"summary": "ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.",
"evidence": "osv:CVE-2019-9917",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-9917",
"aliases": [
"CVE-2019-9917"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/znc/znc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5cde1eb3c112b6f7508521060da1b2b3df88b158"
},
{
"fixed": "64613bc8b6b4adf1e32231f9844d99cd512b8973"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:znc:znc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.7.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "64613bc8b6b4adf1e32231f9844d99cd512b8973"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"znc-1.7.2",
"znc-1.7.2-rc1",
"znc-1.7.1",
"znc-1.7.1-rc1",
"znc-1.7.0",
"znc-1.6.0",
"znc-1.2",
"znc-1.0",
"znc-0.200",
"znc-0.098",
"znc-0.096",
"znc-0.094",
"znc-0.072",
"znc-0.070",
"znc-0.068",
"znc-0.066",
"znc-0.064",
"znc-0.062",
"znc-0.060",
"znc-0.058",
"znc-0.056",
"znc-0.054",
"znc-0.054-rc3",
"znc-0.054-rc2",
"znc-0.054-rc1",
"znc-0.052",
"znc-0.050",
"znc-0.047",
"znc-0.045",
"znc-0.044",
"znc-0.043",
"znc-0.041",
"znc-0.040",
"znc-0.039",
"znc-0.038",
"znc-0.037",
"znc-0.036",
"znc-0.035",
"znc-0.034",
"znc-0.033",
"znc-0.030",
"znc-0.029",
"znc-0.028",
"znc-0.027",
"znc-0.025",
"znc-0.023"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9917.json",
"vanir_signatures": [
{
"id": "CVE-2019-9917-06bf70df",
"digest": {
"threshold": 0.9,
"line_hashes": [
"31243661487519983332586909021597621186",
"165710148128532027485157959188699336235",
"166886895376817625238888457006479704126",
"202216067248535961652918961024433483598"
]
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "test/integration/tests/scripting.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-0d6fb574",
"digest": {
"threshold": 0.9,
"line_hashes": [
"36584977510076312796211728617311074544",
"217198369861479389276039051877825542052",
"206142953363195979325179759694664204998",
"31852148263648964562324318574212806649",
"5731068558472984968260793634951877099",
"4544111393618610573014631413676193190",
"289088587105281216836994535553464028038",
"235947386026669297930310421144780250910",
"336096019935149947584563433318192500410",
"268587052100394892615423073990776036495",
"294516321826862714633202397054723505922",
"293692983013023723515438354985097968040",
"331824959662458729581419606514221289741",
"199929378030754572028680991599821609706",
"214994378381979026070318865429634565927"
]
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/znc.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-0d90913d",
"digest": {
"length": 700,
"function_hash": "296490947557495495698556840745463224975"
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "test/integration/tests/scripting.cpp",
"function": "TEST_F"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-2a52a98e",
"digest": {
"length": 146,
"function_hash": "178979880052083639693043536343234372446"
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/IRCNetwork.cpp",
"function": "CIRCNetwork::SetEncoding"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-7bd8f15c",
"digest": {
"length": 143,
"function_hash": "125101303649470056653133603499956669889"
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/znc.cpp",
"function": "CZNC::FixupEncoding"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-8c77122a",
"digest": {
"length": 173,
"function_hash": "293321452328121892227321759955430517692"
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/User.cpp",
"function": "CUser::SetClientEncoding"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-bc8f8674",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45578857716056444465828692694606500680",
"160927141101229919908502635119851227675",
"330343910617320700491909940605254650939",
"134425585766085492025684800141740463376",
"274035849413902230041635056705243702223",
"252846216533532613068451665393039115978"
]
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/User.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-cbbdb625",
"digest": {
"threshold": 0.9,
"line_hashes": [
"111298836504242310308272496850513804915",
"9388782646776428426526030157509005349",
"257161384823751252615798124025181257527",
"31465414230298443885241880409664645910"
]
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "modules/controlpanel.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-ef33d0b7",
"digest": {
"length": 209,
"function_hash": "233316471373385435759124824689329725750"
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/znc.cpp",
"function": "CZNC::ForceEncoding"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-9917-f2bb6b6d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"103017835089596055557836987390762724639",
"168429236088408346781483381823660671102",
"294478468469689669391425223505312240102",
"45635952350146212716839909869407165573",
"321557855222009988081285520692820523097",
"269180103670117207886993403664586808123"
]
},
"source": "https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973",
"target": {
"file": "src/IRCNetwork.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:00:30Z"
}
}
],
"modified": "2026-10-20T14:00:30.975891824Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTRBTPL7WWKQ7DZ2ALDTCGYUWSE6SL3/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRHCMHI44AW5CJ22WV676BKFUWWCLA7T/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRVSINQHM623GJYYNDSBYSXT2MHKFCYQ/",
"https://seclists.org/bugtraq/2019/Jun/23",
"https://usn.ubuntu.com/3950-1/",
"https://www.debian.org/security/2019/dsa-4463",
"https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "18.10"
},
{
"last_affected": "18.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "28"
},
{
"last_affected": "28"
},
{
"introduced": "29"
},
{
"last_affected": "29"
},
{
"introduced": "30"
},
{
"last_affected": "30"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-9917",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388511,
"published_at": "2019-03-27T06:29:00.39+00:00"
}