Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2019-11479

High

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes.

Published Jun 19, 2019 · Updated Aug 26, 2026 · Also known as DEBIAN-CVE-2019-11479, UBUNTU-CVE-2019-11479, USN-4041-1, USN-4041-2

Key Facts

Patch immediately
  • CVE-2019-11479 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Big-Ip Access Policy Manager (F5), Big-Ip Advanced Firewall Manager (F5), Big-Ip Analytics (F5) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 92% probability of exploitation in the next 30 days.
  • Fixed versions are available, including bpftool 3.10.0-957.21.3.el7, bpftool 4.18.0-80.4.2.el8_0, cluster-md-kmp-default 4.12.14-150.22.1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

92%

Higher than 99.8% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2019-11479 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.

Affected Products

651 affected entries in total
ProductAffected versionsFixed in
Big-Ip Access Policy ManagerF5See advisory11.6.5.1
Big-Ip Advanced Firewall ManagerF5See advisory11.6.5.1
Big-Ip AnalyticsF5See advisory11.6.5.1
Big-Ip Application Acceleration ManagerF5See advisory11.6.5.1
Big-Ip Application Security ManagerF5See advisory11.6.5.1
20 more affected products in the full CVE brief

Patched Releases

bpftool

3.10.0-957.21.3.el7, 4.18.0-80.4.2.el8_0

cluster-md-kmp-default

4.12.14-150.22.1, 4.12.14-197.4.1, 4.12.14-95.19.1, 4.4.121-92.114.1, 4.4.180-94.97.1

cluster-md-kmp-rt

4.12.14-14.8.1, 4.12.14-8.6.1

cluster-network-kmp-default

4.4.121-92.114.1

dlm-kmp-default

4.12.14-150.22.1, 4.12.14-197.4.1, 4.12.14-95.19.1, 4.4.121-92.114.1, 4.4.180-94.97.1

dlm-kmp-rt

4.12.14-14.8.1, 4.12.14-8.6.1

dtrace-modules-3.8.13-118.35.2.el6uek

0.4.5-3.el6

dtrace-modules-3.8.13-118.35.2.el7uek

0.4.5-3.el7

Big-Ip Access Policy Manager

11.6.5.1

Big-Ip Advanced Firewall Manager

11.6.5.1

Big-Ip Analytics

11.6.5.1

Big-Ip Application Acceleration Manager

11.6.5.1

Big-Ip Application Security Manager

11.6.5.1

Big-Ip Domain Name System

11.6.5.1

Big-Ip Edge Gateway

11.6.5.1

Big-Ip Fraud Protection Service

11.6.5.1

Big-Ip Global Traffic Manager

11.6.5.1

Big-Ip Link Controller

11.6.5.1

Big-Ip Local Traffic Manager

11.6.5.1

Big-Ip Policy Enforcement Manager

11.6.5.1

Big-Ip Webaccelerator

11.6.5.1

Big-Iq Centralized Management

<=5.4.0

Traffix Signaling Delivery Controller

<=5.1.0

gfs2-kmp-default

4.12.14-150.22.1, 4.12.14-197.4.1, 4.12.14-95.19.1, 4.4.121-92.114.1, 4.4.180-94.97.1

gfs2-kmp-rt

4.12.14-14.8.1, 4.12.14-8.6.1

Timeline

  1. Publicly disclosed

    Jun 19, 2019

  2. Last updated

    Aug 26, 2026

Weakness Type

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-405 Asymmetric Resource Consumption (Amplification)
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2019-11479 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo