Homepage

Man-in-the-Middle (MitM) The advisory has been revoked - it doesn't affect any version of package linux-qemu-6.12  (opens in a new tab)

Threat Intelligence

EPSS
0.05% (17th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-LINUXQEMU612-15043659
  • published21 Jan 2026
  • disclosed11 Dec 2019
Report a new vulnerability Found a mistake?

Introduced: 11 Dec 2019

CVE-2019-14899  (opens in a new tab)
CWE-300  (opens in a new tab)

Amendment

The Chainguard security team deemed this advisory irrelevant for Chainguard:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linux-qemu-6.12 package and not the linux-qemu-6.12 package as distributed by Chainguard.

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.