CVE catalog

CVE-2019-16275

wpa: CVE-2019-16275

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.21% · Oct 25, 2026

hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwpasid2:2.11-4fixed
Debianwpaforky2:2.11-4fixed
Debianwpatrixie2:2.10-24fixed
Debianwpabookworm2:2.10-12+deb12u3fixed
Debianwpabookworm-security2:2.10-12+deb12u2fixed
Alpinehostapd3.102.8-r2fixed
Alpinehostapd3.112.9-r1fixed
Alpinehostapd3.122.9-r1fixed
Alpinehostapd3.132.9-r1fixed
Alpinehostapd3.142.9-r1fixed
Alpinehostapd3.152.9-r1fixed
Alpinehostapd3.162.9-r1fixed
Alpinehostapd3.172.9-r1fixed
Alpinehostapd3.182.9-r1fixed
Alpinehostapd3.192.9-r1fixed
Alpinehostapd3.202.9-r1fixed
Alpinehostapd3.212.9-r1fixed
Alpinehostapd3.222.9-r1fixed
Alpinehostapd3.232.9-r1fixed
Alpinehostapd3.242.9-r1fixed
Alpinehostapd3.72.6-r6fixed
Alpinehostapd3.82.6-r7fixed
Alpinehostapd3.92.7-r5fixed
Alpinewpa_supplicant3.102.8-r3fixed
Alpinewpa_supplicant3.112.9-r5fixed
Alpinewpa_supplicant3.122.9-r5fixed
Alpinewpa_supplicant3.132.9-r5fixed
Alpinewpa_supplicant3.142.9-r5fixed
Alpinewpa_supplicant3.152.9-r5fixed
Alpinewpa_supplicant3.162.9-r5fixed
Alpinewpa_supplicant3.172.9-r5fixed
Alpinewpa_supplicant3.182.9-r5fixed
Alpinewpa_supplicant3.192.9-r5fixed
Alpinewpa_supplicant3.202.9-r5fixed
Alpinewpa_supplicant3.212.9-r5fixed
Alpinewpa_supplicant3.222.9-r5fixed
Alpinewpa_supplicant3.232.9-r5fixed
Alpinewpa_supplicant3.242.9-r5fixed
Alpinewpa_supplicant3.72.6-r16fixed
Alpinewpa_supplicant3.82.6-r16fixed
Alpinewpa_supplicant3.92.7-r5fixed
Ubuntuwpa16.042.4-0ubuntu3vulnerable
Ubuntuwpa16.042.4-0ubuntu4vulnerable
Ubuntuwpa16.042.4-0ubuntu5vulnerable
Ubuntuwpa16.042.4-0ubuntu6vulnerable
Ubuntuwpa16.042.4-0ubuntu6.2vulnerable
Ubuntuwpa16.042.4-0ubuntu6.3vulnerable
Ubuntuwpa16.042.4-0ubuntu6.4vulnerable
Ubuntuwpa16.042.4-0ubuntu6.5vulnerable
Ubuntuwpa16.042.4-0ubuntu6.6fixed
Ubuntuwpa18.042.4-0ubuntu10vulnerable
Ubuntuwpa18.042:2.4-1.1ubuntu1vulnerable
Ubuntuwpa18.042:2.6-15ubuntu1vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.1vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.2vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.3vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.4vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.5fixed
Ubuntuwpapro1.0-3ubuntu2vulnerable
Ubuntuwpapro1.0-3ubuntu3vulnerable
Ubuntuwpapro1.0-3ubuntu4vulnerable
Ubuntuwpapro2.1-0ubuntu1vulnerable
Ubuntuwpapro2.1-0ubuntu1.1vulnerable
Ubuntuwpapro2.1-0ubuntu1.2vulnerable
Ubuntuwpapro2.1-0ubuntu1.3vulnerable
Ubuntuwpapro2.1-0ubuntu1.4vulnerable
Ubuntuwpapro2.1-0ubuntu1.5vulnerable
Ubuntuwpapro2.1-0ubuntu1.6vulnerable
Ubuntuwpapro2.1-0ubuntu1.7vulnerable
Ubuntuwpapro2.1-0ubuntu1.7+esm1vulnerable
Ubuntuwpapro2.1-0ubuntu1.7+esm2fixed
Ubuntuwpapro1.0-3ubuntu2vulnerable
Ubuntuwpapro1.0-3ubuntu3vulnerable
Ubuntuwpapro1.0-3ubuntu4vulnerable
Ubuntuwpapro2.1-0ubuntu1vulnerable
Ubuntuwpapro2.1-0ubuntu1.1vulnerable
Ubuntuwpapro2.1-0ubuntu1.2vulnerable
Ubuntuwpapro2.1-0ubuntu1.3vulnerable
Ubuntuwpapro2.1-0ubuntu1.4vulnerable
Ubuntuwpapro2.1-0ubuntu1.5vulnerable
Ubuntuwpapro2.1-0ubuntu1.6vulnerable
Ubuntuwpapro2.1-0ubuntu1.7vulnerable
Ubuntuwpapro2.1-0ubuntu1.7+esm1vulnerable
Ubuntuwpapro2.1-0ubuntu1.7+esm2fixed
Ubuntuwpa16.042.4-0ubuntu3vulnerable
Ubuntuwpa16.042.4-0ubuntu4vulnerable
Ubuntuwpa16.042.4-0ubuntu5vulnerable
Ubuntuwpa16.042.4-0ubuntu6vulnerable
Ubuntuwpa16.042.4-0ubuntu6.2vulnerable
Ubuntuwpa16.042.4-0ubuntu6.3vulnerable
Ubuntuwpa16.042.4-0ubuntu6.4vulnerable
Ubuntuwpa16.042.4-0ubuntu6.5vulnerable
Ubuntuwpa16.042.4-0ubuntu6.6fixed
Ubuntuwpa18.042.4-0ubuntu10vulnerable
Ubuntuwpa18.042:2.4-1.1ubuntu1vulnerable
Ubuntuwpa18.042:2.6-15ubuntu1vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.1vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.2vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.3vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.4vulnerable
Ubuntuwpa18.042:2.6-15ubuntu2.5fixed
Susehostapdpackage hub 15 sp22.9-bp152.2.3.1fixed
Opensusehostapdleap 15.22.9-lp152.2.3.1fixed
Susewpa_supplicanthpe helion openstack 82.6-15.13.1fixed
Susewpa_supplicantopenstack cloud 72.6-15.13.1fixed
Susewpa_supplicantopenstack cloud 82.6-15.13.1fixed
Susewpa_supplicantopenstack cloud 92.6-15.13.1fixed
Susewpa_supplicantopenstack cloud crowbar 82.6-15.13.1fixed
Susewpa_supplicantopenstack cloud crowbar 92.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server for sap applications 12 sp22.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server for sap applications 12 sp32.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server for sap applications 12 sp42.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server 12 sp2-ltss2.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server 12 sp2-bcl2.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server 12 sp3-ltss2.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server 12 sp3-bcl2.6-15.13.1fixed
Susewpa_supplicantlinux enterprise server 12 sp4-ltss2.6-15.13.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwpasourcesid2:2.9-2not yet assignedNot reported[940080]
Debianwpasourceforky2:2.9-2not yet assignedNot reported[940080]
Debianwpasourcetrixie2:2.9-2not yet assignedNot reported[940080]
Debianwpasourcebookworm2:2.9-2not yet assignedNot reported[940080]
Alpinehostapdapk3.102.8-r2Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.112.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.122.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.132.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.142.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.152.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.162.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.172.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.182.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.192.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.202.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.212.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.222.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.232.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.242.9-r1Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.72.6-r6Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.82.6-r7Not reportedALPINE-CVE-2019-16275Not reported
Alpinehostapdapk3.92.7-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.102.8-r3Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.112.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.122.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.132.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.142.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.152.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.162.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.172.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.182.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.192.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.202.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.212.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.222.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.232.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.242.9-r5Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.72.6-r16Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.82.6-r16Not reportedALPINE-CVE-2019-16275Not reported
Alpinewpa_supplicantapk3.92.7-r5Not reportedALPINE-CVE-2019-16275Not reported
Ubuntuwpadeb16.042.4-0ubuntu6.6Not reportedUSN-4136-1Not reported
Ubuntuwpadeb18.042:2.6-15ubuntu2.5Not reportedUSN-4136-1Not reported
Ubuntuwpadebpro2.1-0ubuntu1.7+esm2Not reportedUSN-4136-2Not reported
Ubuntuwpadebpro2.1-0ubuntu1.7+esm2Not reportedUBUNTU-CVE-2019-16275Not reported
Ubuntuwpadeb16.042.4-0ubuntu6.6Not reportedUBUNTU-CVE-2019-16275Not reported
Ubuntuwpadeb18.042:2.6-15ubuntu2.5Not reportedUBUNTU-CVE-2019-16275Not reported
Susehostapdrpmpackage hub 15 sp22.9-bp152.2.3.1Not reportedOPENSUSE-SU-2021:0545-1Not reported
Opensusehostapdrpmleap 15.22.9-lp152.2.3.1Not reportedOPENSUSE-SU-2021:0519-1Not reported
Susewpa_supplicantrpmhpe helion openstack 82.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmopenstack cloud 72.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmopenstack cloud 82.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmopenstack cloud 92.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmopenstack cloud crowbar 82.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmopenstack cloud crowbar 92.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server for sap applications 12 sp22.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server for sap applications 12 sp32.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server for sap applications 12 sp42.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server 12 sp2-ltss2.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server 12 sp2-bcl2.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server 12 sp3-ltss2.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server 12 sp3-bcl2.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported
Susewpa_supplicantrpmlinux enterprise server 12 sp4-ltss2.6-15.13.1Not reportedSUSE-SU-2021:0478-1Not reported

[Debian bug #940080]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [eapoltest]Fixed

    Source package: [wpa]

    Details (4)
    • 2:2.10-12+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

  • [hostapd]Fixed

    Source package: [wpa]

    Details (4)
    • 2:2.10-12+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

  • Source package: [wpa]

    Details (4)
    • 2:2.10-12+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

  • [wpagui]Fixed

    Source package: [wpa]

    Details (4)
    • 2:2.10-12+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

  • Source package: [wpa]

    Details (4)
    • 2:2.10-12+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

    • 2:2.10-12+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · bookworm; dsa · wpa · debian · 12

[Debian 13 (Trixie)]

  • [eapoltest]Fixed

    Source package: [wpa]

    Details (2)
    • 2:2.10-24 · amd64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

    • 2:2.10-24 · arm64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

  • [hostapd]Fixed

    Source package: [wpa]

    Details (2)
    • 2:2.10-24 · amd64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

    • 2:2.10-24 · arm64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

  • Source package: [wpa]

    Details (2)
    • 2:2.10-24 · amd64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

    • 2:2.10-24 · arm64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

  • [wpagui]Fixed

    Source package: [wpa]

    Details (2)
    • 2:2.10-24 · amd64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

    • 2:2.10-24 · arm64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

  • Source package: [wpa]

    Details (2)
    • 2:2.10-24 · amd64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

    • 2:2.10-24 · arm64 · trixie

      Fixed · Fixed: 2:2.9-2

      dsa · wpa · debian · 13

Observed:

References