CVE-2019-6486

—

CVSS 3.0

8.2 high

EPSS

4%p91

Published

Jan 24, 2019 (Jan 24, 2019)

Modified

Jun 17, 2026

Description

Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

Vendors: golang debian opensuse
Products: go, debian linux, leap
Weakness: CWE-770
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (4.3%)

In the news0 stories

No ingested article mentions this CVE yet.