CVE-2019-11494

25

FAUCET Score

CVE-2019-11494 describes a denial-of-service vulnerability affecting Dovecot IMAP Server versions 2.3.3 through 2.3.5.2. The flaw allows an unauthenticated attacker to crash the submission-login service by prematurely disconnecting during the AUTH command. Rated 7.5 HIGH, this vulnerability has a network attack vector, low attack complexity, and high impact on availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.3.3, <= 2.3.5.2CPE matchmatch criteria	cpe:2.3:a:dovecot:dovecot::::::::
		29CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:29:::::::*
		30CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:30:::::::*
		15.0CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.0:::::::*
		15.1CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.1:::::::*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

2.43%

Probability of exploitation in next 30 days

EPSS Percentile

82.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0243 is in the 69th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

denopatch availablevia llm_extracted

drupalpatch availablevia llm_extracted

freeswitchpatch availablevia llm_extracted

synologypatch availablevia llm_extracted

Fixed in: null

broadcomvendor investigatingvia llm_extracted

ubiquitivendor investigatingvia llm_extracted

Vendor Advisories (7)

redhatCVE-2019-11494Moderate

dovecot: premature disconnection from client during AUTH command leads to crash and possible DoS

drupalllm-drupal-c4aebef38c585eac

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting

ubiquitillm-ubiquiti-9af0f4e24a6c3efd

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting

synologyllm-synology-378f4c18046eddb4

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting

denollm-deno-aecdaf38d96f9cd1

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting

broadcomllm-broadcom-0974400ba06f3011

CVE-2019-11494: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting

freeswitchllm-freeswitch-d1dae65e61d630b2

Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting

References

lists.opensuse.org / opensuse-security-announce/2019-10/msg00024.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-10/msg00026.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS

dovecot.org / download.html

Product

dovecot.org / security.html

Vendor Advisory