Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

BWA 0.7.17 may crash or be exploited by specially crafted FASTA files

CVE-2019-11371 · published 7 years ago
Summary

The BWA alignment program version 0.7.17 on Debian can run into a memory error when it processes a FASTA file with an unusually long prefix. This could cause the program to stop working or allow an attacker to run unwanted code. Update BWA to a newer version or avoid using FASTA files with very long prefixes until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian bwa All versions
Debian:13 debian bwa All versions
Debian:14 debian bwa All versions
– burrow-wheeler_aligner_project burrow-wheeler_aligner 0.7.17
cpe:2.3:a:burrow-wheeler_aligner_project:burrow-wheeler_aligner:0.7.17:r1198:*:*:*:*:*:*
Original advisory text
BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.
BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.
References
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published20 Apr 2019
Updated3 Nov 2026
First seen21 Sep 2026
Sources
DEBIAN-CVE-2019-11371 · OSV
CVE-2019-11371 · NVD
Track software like this
Free during beta