CVE-2019-11555: Null Pointer Dereference
Last updated 25 August 2025
Other sources
The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpasupplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eapserver/eapserverpwd.c and eappeer/eappwd.c.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-11555?
CVE-2019-11555 is a vulnerability in the EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP peer) before version 2.8 that can result in process termination due to a NULL pointer dereference.
How severe is CVE-2019-11555?
CVE-2019-11555 has a severity level keyword of 'high' and a severity value of 5.9.
What software versions are affected by CVE-2019-11555?
The affected software versions include hostapd (EAP server) before version 2.8 and wpa_supplicant (EAP peer) before version 2.8.
How can I fix CVE-2019-11555?
To fix CVE-2019-11555, you should upgrade hostapd (EAP server) to version 2.8 or later and wpa_supplicant (EAP peer) to version 2.8 or later.
Where can I find more information about CVE-2019-11555?
You can find more information about CVE-2019-11555 at the following references: [link1], [link2], [link3].