cve.bz

CVE-2019-6486

8.2 highEPSS 4.5%

High (8.2). EPSS 4.5% chance of exploitation in the next 30 days. Fixed in stdlib 1.10.8, 1.11.5.

Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

Severity

CVSS 3.0

8.2 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS
4.5% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE
CWE-770
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GO-2022-0217Gostdlib<1.10.8
>=1.11.0-0 <1.11.5		1.10.8, 1.11.5

References

Check your stackJSON