Is CVE-2019-1559 actively exploited?

No active exploitation of CVE-2019-1559 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-1559 be exploited remotely?

Yes. CVE-2019-1559 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-1559?

CVE-2019-1559 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2019-1559

MEDIUM

CVE-2019-1559

CWE-203Published: February 27, 2019· Updated: Jun 17, 2026

5.9

CVSS v3.1

Official Description

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

NVD Source

Technical Analysis

CVE-2019-1559 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.9.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

Canonical1 product(s)

ubuntu linux

Debian1 product(s)

debian linux

f515 product(s)

big-ip access policy managerbig-ip advanced firewall managerbig-ip analyticsbig-ip application acceleration managerbig-ip application security managerbig-ip domain name systembig-ip edge gatewaybig-ip fraud protection servicebig-ip global traffic managerbig-ip link controllerbig-ip local traffic managerbig-ip policy enforcement manager+3

Fedora1 product(s)

fedora

mcafee4 product(s)

agentdata exchange layerthreat intelligence exchange serverweb gateway

netapp38 product(s)

active iq unified manageraltavaultcloud backupclustered data ontap antivirus connectorelement softwarehci management nodehyper converged infrastructureoncommand insightoncommand unified manageroncommand unified manager core packageoncommand workflow automationontap select deploy+26

Node.js1 product(s)

node.js

OpenSSL1 product(s)

openssl

openSUSE1 product(s)

leap

Oracle18 product(s)

api gatewaybusiness intelligencecommunications diameter signaling routercommunications performance intelligence centercommunications session border controllercommunications session routercommunications unified session managerendeca serverenterprise manager base platformenterprise manager ops centerjd edwards enterpriseone toolsjd edwards world security+6

Palo Alto Networks1 product(s)

pan-os

Red Hat7 product(s)

jboss enterprise web serverenterprise linuxvirtualizationvirtualization hostenterprise linux desktopenterprise linux serverenterprise linux workstation

tenable1 product(s)

nessus

Source: NVD CPE · 127 total CPE entries