CVE-2019-25544 Pidgin 2.13.0 Denial of Service via Malformed Username
Local attackers can crash Pidgin by entering an excessively long username during account creation, causing application unavailability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25544?
CVE-2019-25544 is a medium-severity denial of service vulnerability in Pidgin Pidgin, published on 21 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.
Weakness: CWE-807
Which versions are affected by CVE-2019-25544?
It affects 1 product.
Linux distribution packages (14)
farstream SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.2.8-5.2.4 |
gssdp SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.14.16-7.2.1 |
gupnp SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.20.18-8.5.2 |
gupnp-igd SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.2.4-6.2.2 |
libgnt SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 2.14.3-4.3.8 |
libnice SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.1.13-7.2.3 |
pidgin SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 2.14.8-3.9.3 |
farstream SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.2.8-5.2.4 |
gssdp SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.14.16-7.2.1 |
gupnp SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.20.18-8.5.2 |
gupnp-igd SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.2.4-6.2.2 |
libgnt SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.14.3-4.3.8 |
libnice SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.1.13-7.2.3 |
pidgin SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.14.8-3.9.3 |
Products include Pidgin Pidgin.
How do I fix CVE-2019-25544?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-25544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25544 exists.
Other vulnerabilities in Pidgin Pidgin
Sources
Also known as GHSA-hvgh-8gm9-9vq2, SUSE-SU-2026:2967-1, UBUNTU-CVE-2019-25544.