{"action":"Upgrade wpa to 2:2.7+git20190128+0c1e29f-5 or later.","affected":[{"fixed":"2:2.7+git20190128+0c1e29f-5","introduced":"0"}],"component":"wpa","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2:2.7+git20190128+0c1e29f-5"],"id":"tcs_01M5NDPEFFXH17R5DSZRXSYDVC","modified_at":"2026-09-21T07:01:28.316510810Z","published_at":"2019-04-26T22:29:00.357Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-11555","https://security-tracker.debian.org/tracker/CVE-2019-11555"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-11555#Debian:14/wpa","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-11555"}],"summary":"The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment"}