Description
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ESXi and Horizon DaaS | ESXi 6.7 prior to patch release ESXi670-201912001, ESXi 6.5 prior to patch release ESXi650-201912001, ESXi 6.0 prior to patch release ESXi600-201912001 and Horizon DaaS 8.x prior to BZ-2467224-Disable_SLPD_service_permanently_801_Hotfix. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | openslp-dfsg | 1.2.1-10+deb8u2 | DLA-2025-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | openslp-dfsg | 1.2.1-11ubuntu0.16.04.2 | USN-4919-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | openslp-dfsg | 1.2.1-9ubuntu0.3+esm1 | USN-4919-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openslp +2 | 1:2.0.0-8.el7_7 | RHSA-2019:4240 |
| RHEL 6 | openslp +2 | 1:2.0.0-4.el6_10 | RHSA-2020:0199 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | openslp +2 | 1:2.0.0-8.amzn2 | ALAS2-2019-1378 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openslp | 2.0.0-26 | — |
| Azure Linux 2 (CBL-Mariner) | openslp | 2.0.0-26 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openslp +2 | 1:2.0.0-8.el7_7 | ELSA-2019-4240 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
dgh05t/VMware_ESXI_OpenSLP_PoCs ★ 68 · Feb 4, 2021
CVE-2020-3992 & CVE-2019-5544
-
HynekPetrak/CVE-2019-5544_CVE-2020-3992 ★ 50 · Dec 1, 2020
Python / scapy module implementing SRVLOC/SLP protocol and scans for enabled OpenSLP services.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- VMware ESXi SLP - Heap Overflow DoS network/cves/2019/CVE-2019-5544.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 6
- USN-4919-1 openslp-dfsg vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- RHSA-2019:4240 Red Hat Security Advisory: openslp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:0199 Red Hat Security Advisory: openslp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-2025-1 openslp-dfsg - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ALAS2-2019-1378 Critical: openslp security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 18, 2019
- ELSA-2019-4240 Critical: openslp security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 16, 2019
References
- http://www.vmware.com/security/advisories/VMSA-2019-0022.html
- [oss-security] 20191210 Re: CVE-2019-5544 openslp 1.2.1, 2.0.0 heap overflow vulnerability mailing-list
- [oss-security] 20191211 Re: CVE-2019-5544 openslp 1.2.1, 2.0.0 heap overflow vulnerability mailing-list
- RHSA-2019:4240 vendor-advisory
- FEDORA-2019-1e5ae33e87 vendor-advisory
- FEDORA-2019-86bceb61b3 vendor-advisory
- RHSA-2020:0199 vendor-advisory
- GLSA-202005-12 vendor-advisory