{"cve":"CVE-2019-15149","nvd":{"published":"2019-08-18T20:15:09.220","modified":"2026-06-17T02:19:48.607","status":"Modified","description":"core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-254"],"references":["https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc","https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18","https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc","https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18"],"products":["networkgenomics:mitogen"],"source":"nvd","synced_at":"2026-10-19T20:58:39.700375520+00:00"},"epss":{"cve":"CVE-2019-15149","score":0.01646,"percentile":0.76459,"date":"2026-10-31"},"kev":null,"osv":[{"id":"PYSEC-2019-104","url":"https://osv.dev/vulnerability/PYSEC-2019-104","summary":"","modified":"2023-11-08T04:01:12.761712Z","packages":[{"ecosystem":"PyPI","name":"mitogen","purl":"pkg:pypi/mitogen","ranges":["<0.2.8"],"fixed":["0.2.8"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}