CVE-2019-11479

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 91.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-19 · updated 2026-06-17
Weakness: CWE-405

Description

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10, 19.04
F5 BIG-IP APM: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
BIG-IP: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Big-Ip Analytics: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Networks, Inc. BIG-IP (AAM): from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
BIG-IP ASM: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 BIG-IP DNS: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Big-Ip Edge Gateway: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Big-Ip Fraud Protection Service: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Big-Ip Global Traffic Manager: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Big-Ip Link Controller: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 BIG-IP (LTM): from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Networks, Inc. BIG-IP (PEM): from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 Big-Ip Webaccelerator: from 11.5.2 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.2 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
F5 BIG-IQ: from 5.1.0 through 5.4.0; from 6.0.0 through 6.1.0
F5 Networks, Inc. Enterprise Manager: 3.1.1
F5 Networks, Inc. iWorkflow: 2.3.0
F5 Traffix SDC: from 5.0.0 through 5.1.0
Linux kernel: from 4.4 before 4.4.182; from 4.9 before 4.9.182; from 4.14 before 4.14.127; from 4.19 before 4.19.52; from 5.1 before 5.1.11 — fixed in 4.14.127, 4.19.52, 4.4.182, 4.9.182, 5.1.11
Red Hat Enterprise Linux: 7.0
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; BIG-IP 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Big-Ip Analytics 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Networks, Inc. BIG-IP (AAM) 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; BIG-IP ASM 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 BIG-IP DNS 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Big-Ip Edge Gateway 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Big-Ip Fraud Protection Service 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Big-Ip Global Traffic Manager 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Big-Ip Link Controller 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 BIG-IP (LTM) 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; F5 Networks, Inc. BIG-IP (PEM) 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-11479 or the next vulnerability affects your stack