vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-14818

HIGH
7.5
CVSS Score
Published: November 14, 2019 at 12:00 AM UTC
Updated: June 17, 2026 at 02:19 AM UTC
5 products affected across 3 vendorsFedoraOpenStackData Plane Development Kit

Using dpdk by DPDK?

Get instant alerts when new vulnerabilities affect dpdk - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 3%

Description

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Data Plane Development Kit· Dpdk
95%
v < 16.11.10v < 17.11.8v < 18.11.4v < 19.08.116.04 ≤ v < 16.11.1017.02 ≤ v < 17.11.818.02 ≤ v < 18.11.419.02 ≤ v < 19.08.1
Affected range stops below 16.11.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 17.11.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 18.11.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 19.08.1, so it looks safe — our inference, not a vendor statement
Fedora· Fedora Projectrpm
95%
31
Enterprise Linux Fast Datapath· Red Hat
95%
7.08.0
OpenStack· Red Hatdrupal
95%
10
Virtualization Eus· Red Hat
95%
4.2

References (8)

Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2020:0165
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2020:0166
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2020:0168
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2020:0171
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2020:0172
Issue TrackingPatchVendor Advisory
Source: [email protected]
https://bugs.dpdk.org/show_bug.cgi?id=363
Issue TrackingPatchThird Party Advisory
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card