CVE-2019-6486: High severity golang vulnerability
Published Jan 24, 2019
·Updated
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
Affected Software
6 affected componentsFixes available
debian/golang-1.11
1.11.6-1+deb10u41.11.6-1+deb10u7
Golang Go<1.10.8
Golang Go>=1.11.1<1.11.5
Debian Debian Linux=8.0
Debian Debian Linux=9.0
openSUSE Leap=15.0
Remediation
Event History
Jan 24, 2019
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Sep 3, 2025
Data Sourced
via Microsoft·09:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-6486?
CVE-2019-6486 has a severity level that could lead to denial of service and potentially allow ECDH private key recovery attacks.
2
How do I fix CVE-2019-6486?
To fix CVE-2019-6486, upgrade to Go version 1.11.6-1+deb10u4 or 1.11.6-1+deb10u7.
3
What versions of Go are affected by CVE-2019-6486?
CVE-2019-6486 affects Go versions before 1.10.8 and 1.11.x versions prior to 1.11.5.
4
Which operating systems are impacted by CVE-2019-6486?
CVE-2019-6486 impacts Debian Linux versions 8.0 and 9.0, as well as OpenSUSE Leap version 15.0.
5
What types of attacks can CVE-2019-6486 enable?
CVE-2019-6486 can enable attacks that lead to denial of service through high CPU consumption and possible ECDH private key recovery.