Critical
Security advisory
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-16239
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:28 UTC · Revision 1
Source evidence
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
osv:CVE-2019-16239
Complete source record
{
"id": "777555873bf22d4f849867db9c8440cfeea6b00944fea977922de1a8bce986bc",
"url": "https://osv.dev/vulnerability/CVE-2019-16239",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-16239",
"summary": "process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.",
"evidence": "osv:CVE-2019-16239",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-16239",
"aliases": [
"CVE-2019-16239"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openconnect/openconnect",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "7980a733f52031c369594318956bb1f1767762e3"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:infradead:openconnect:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "8.05"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v8.04",
"v8.03",
"v8.02",
"v8.01",
"v8.00",
"v7.08",
"v7.07",
"v7.06",
"v7.05",
"v7.04",
"v7.03",
"v7.02",
"v7.01",
"v7.00",
"v6.00",
"v5.99",
"v5.03",
"v5.02",
"v5.01",
"v5.00",
"v4.99",
"v4.07",
"v4.06",
"v4.05",
"v4.04",
"v4.03",
"v4.02",
"v4.01",
"v4.00",
"v3.99",
"v3.20",
"v3.19",
"v3.18",
"v3.17",
"v3.16",
"v3.15",
"v3.14",
"v3.13",
"v3.12",
"v3.11",
"v3.10",
"v3.02",
"v3.01",
"v3.00",
"v2.26",
"v2.25",
"v2.24",
"v2.23",
"v2.22",
"v2.21",
"v2.20",
"v2.12",
"v2.11",
"v2.10",
"v2.01",
"v2.00",
"v1.40",
"v1.30",
"v1.20",
"v1.10",
"v1.00",
"v0.99",
"v0.98",
"v0.97",
"v0.96",
"v0.95",
"v0.94",
"v0.93",
"v0.92",
"v0.91",
"v0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16239.json"
}
}
],
"modified": "2026-10-24T10:30:53.765544578Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX56KYWC7X4ETV4P6HGJC7GZUEBITBBS/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDMZGNBLZZKAGBI2PNXYWWKLD2LXKFH6/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WI7ZENFAWCHF2RU4NHPL2CU4WGZ4BNDJ/",
"https://t2.fi/schedule/2019/",
"https://lists.debian.org/debian-lts-announce/2019/10/msg00003.html",
"https://seclists.org/bugtraq/2020/Jan/31",
"https://usn.ubuntu.com/4565-1/",
"https://www.debian.org/security/2020/dsa-4607"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "29"
},
{
"last_affected": "29"
},
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.0"
},
{
"last_affected": "15.0"
},
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-16239",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 438005,
"published_at": "2019-09-17T12:15:10.56+00:00"
}