Critical severity9.8OSV Advisory· Published Mar 30, 2019· Updated Jun 17, 2026

CVE-2019-10648

Description

Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
net.sf.robocode:robocode.hostMaven	< 1.9.3.7	1.9.3.7

Affected products

Robo Code/RobocodeOSV2 versions
VER_1_7_4_3, VER_1_9_2_1, VER_1_9_2_2, …+ 1 more
- (no CPE)range: VER_1_7_4_3, VER_1_9_2_1, VER_1_9_2_2, …
- (no CPE)range: <=1.9.3.5
ghsa-coords
pkg:maven/net.sf.robocode/robocode.host
Range: < 1.9.3.7

Patches

Vulnerability mechanics

References

github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bdnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-q2xp-75m7-gv52ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2019-10648ghsaADVISORY
sourceforge.net/p/robocode/bugs/406/nvdPermissions RequiredThird Party Advisory
sourceforge.net/p/robocode/bugs/406ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000