CVE catalog

CVE-2019-10050

UBUNTU-CVE-2019-10050

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.46% · Oct 25, 2026

A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansuricata131:4.1.4-1fixed
Debiansuricata141:4.1.4-1fixed
Ubuntusuricata16.042.0.8-1build1vulnerable
Ubuntusuricata16.042.0.9-1vulnerable
Ubuntusuricata16.042.0.10-1vulnerable
Ubuntusuricata16.042.0.10-2vulnerable
Ubuntusuricata16.042.0.11-1vulnerable
Ubuntusuricata16.043.0-1vulnerable
Ubuntusuricata18.043.2-2ubuntu3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansuricatadeb131:4.1.4-1Not reportedDEBIAN-CVE-2019-10050Not reported
Debiansuricatadeb141:4.1.4-1Not reportedDEBIAN-CVE-2019-10050Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [suricata]Fixed
    Details (4)

    • 1:7.0.10-1+deb13u4 · amd64 · trixie

      Fixed · Fixed: 1:4.1.4-1

      pypi · suricata · debian · 13

    • 1:7.0.10-1+deb13u4 · arm64 · trixie

      Fixed · Fixed: 1:4.1.4-1

      pypi · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1:4.1.4-1

      pypi · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1:4.1.4-1

      pypi · suricata · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]