CVE-2019-16239: Buffer Overflow
Published Sep 17, 2019
·Updated
Last updated 29 July 2025
Other sources
processhttpresponse in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
— MITRE
Affected Software
12 affected componentsFixes available
debian/openconnect<=8.02-1, <=7.08-1
8.02-1+deb10u17.08-1+deb9u18.02-1.1
Infradead Openconnect<8.05
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Fedoraproject Fedora=31
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Canonical Ubuntu Linux=18.04
openSUSE Leap=15.0
openSUSE Leap=15.1
debian/openconnect
8.10-29.01-39.12-3+deb13u29.12-3.3
Remediation
Event History
Sep 17, 2019
CVE Published
via MITRE·11:37 AM
Data Sourced
via MITRE·11:37 AM
Description
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·11:51 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·11:51 PM
DescriptionAffected Software
Data Sourced
via Launchpad·11:52 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16239?
CVE-2019-16239 is classified as a high severity vulnerability due to its potential to exploit buffer overflow conditions.
2
How do I fix CVE-2019-16239?
To fix CVE-2019-16239, update OpenConnect to version 8.05 or later.
3
Which versions of OpenConnect are affected by CVE-2019-16239?
CVE-2019-16239 affects OpenConnect versions below 8.05.
4
Can CVE-2019-16239 lead to remote code execution?
Yes, CVE-2019-16239 can potentially lead to remote code execution through crafted HTTP responses.
5
Is CVE-2019-16239 only applicable to Debian systems?
No, CVE-2019-16239 affects multiple distributions, including Fedora and Ubuntu, alongside Debian.