LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19275: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read.

typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-19275 is a denial-of-service risk in typed_ast 1.3.0 and 1.3.1. If a service parses Python source supplied by users, specially formed input may crash the Python interpreter process even without executing the code. Business impact is mainly service disruption, not confirmed data theft or remote code execution.

Executive priority

Treat this as a targeted availability issue. Prioritize if your business accepts Python code from users or customers for analysis, grading, linting, or automation. Otherwise, handle through normal dependency maintenance.

Technical view

The issue is an out-of-bounds read in ast_for_arguments while parsing Python source into an AST. The CVE states affected typed_ast versions are 1.3.0 and 1.3.1, and that certain Python 3.8.0-alpha prereleases were also affected. Public references include upstream typed_ast and CPython commits plus Fedora package advisory material.

Likely exposure

Exposure is most likely in web services, CI tools, linters, code analysis platforms, or education sandboxes that parse untrusted Python source using affected typed_ast versions. Systems only parsing trusted local code have lower practical risk.

Exploitation context

The provided sources do not show active exploitation, and the CVE is not marked KEV. Exploitation requires the ability to make a Python interpreter parse attacker-controlled Python source. The stated impact is process crash, so availability is the primary concern.

Researcher notes

Evidence supports crash risk from parsing, not code execution. The affected product data in the bundle is sparse, but the description clearly names typed_ast 1.3.0 and 1.3.1. Do not broaden scope beyond typed_ast and noted Python 3.8.0-alpha prereleases without additional vendor evidence.

Mitigation direction

  • Inventory typed_ast usage and remove versions 1.3.0 and 1.3.1.
  • Apply upstream or distribution packages that include the referenced fixes.
  • Avoid affected Python 3.8.0-alpha prereleases in any environment.
  • Limit and isolate services that parse untrusted Python source.
  • Monitor vendor advisories for exact fixed package guidance.

Validation and detection

  • Search SBOMs and lockfiles for typed_ast 1.3.0 or 1.3.1.
  • Identify endpoints or jobs that parse user-submitted Python code.
  • Confirm deployed runtimes are not affected Python 3.8.0-alpha prereleases.
  • Verify updated packages trace to upstream or distribution fixes.
  • Review crash logs for parser-related interpreter exits.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-19275 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.