Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-5062: hostapd 2.6 may disconnect Wi‑Fi clients using 802.11w

CVE-2019-5062 · published 6 years ago

Summary

The Wi‑Fi access point software hostapd version 2.6 can be tricked into kicking out devices that are using the 802.11w protection feature. An attacker who pretends to start a new connection can force the access point to de‑authenticate those devices, causing a temporary loss of network access. Update hostapd to a patched version or apply the vendor's recommended configuration change to stop the disruption.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	wpa	All versions
Debian:13	debian	wpa	All versions
Debian:14	debian	wpa	All versions
–	w1.fi	hostapd	2.6 `cpe:2.3:a:w1.fi:hostapd:2.6:::::::*`
Ubuntu:Pro:14.04:LTS	canonical	wpa	All versions

Original advisory text

An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.

References

https://security-tracker.debian.org/tracker/CVE-2019-5062 Vendor Advisory
https://ubuntu.com/security/CVE-2019-5062 Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0850 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-5062 Third Party Advisory

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-440Expected Behavior Violation

CWE-346Origin Validation Error

Timeline

Published12 Dec 2019

Updated4 Nov 2026

First seen21 Sep 2026

Sources

DEBIAN-CVE-2019-5062 · OSV

CVE-2019-5062 · NVD

UBUNTU-CVE-2019-5062 · OSV

Track software like this

Free during beta