Which CVEs affect U-Boot 2019.04?
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2019-11059 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14192 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14193 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14194 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14195 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14196 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14198 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14199 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14200 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14201 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14202 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14203 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2019-14204 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2020-8432 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2022-30767 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2022-34835 | critical | 9.8 | 2022.07 | per vulnerability databases |
| CVE-2025-70290 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2025-70293 | critical | 9.8 | not stated | per vulnerability databases |
| CVE-2026-29009 | critical | 9.8 | 2026.04 | per vulnerability databases |
| CVE-2019-14197 | critical | 9.1 | not stated | per vulnerability databases |
| CVE-2026-15390 | critical | 9.0 | not stated | per vulnerability databases |
| CVE-2026-46728 | high | 8.8 | 2026.04 | per vulnerability databases |
| CVE-2026-71971 | high | 8.8 | 2026.10-rc3 | per vulnerability databases |
| CVE-2026-74220 | high | 8.8 | 2026.10-rc5 | per vulnerability databases |
| CVE-2026-74221 | high | 8.8 | 2026.10-rc5 | per vulnerability databases |
| CVE-2026-74222 | high | 8.8 | 2026.10-rc5 | per vulnerability databases |
| CVE-2026-29008 | high | 8.7 | 2026.04 | per vulnerability databases |
| CVE-2024-42040 | high | 8.1 | not stated | per vulnerability databases |
| CVE-2019-13104 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2019-13105 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2019-13106 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2021-27097 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2021-27138 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2022-30790 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2022-33967 | high | 7.8 | not stated | per vulnerability databases |
| CVE-2024-57258 | high | 7.8 | 2025.01-rc1 | per vulnerability databases |
| CVE-2019-13103 | high | 7.1 | not stated | per vulnerability databases |
| CVE-2022-2347 | high | 7.1 | not stated | per vulnerability databases |
| CVE-2026-74225 | high | 7.1 | 2026.10-rc5 | per vulnerability databases |
| CVE-2026-29007 | medium | 6.9 | 2026.04 | per vulnerability databases |
| CVE-2024-57254 | medium | 6.8 | 2025.01-rc1 | per vulnerability databases |
| CVE-2024-57255 | medium | 6.8 | 2025.01-rc1 | per vulnerability databases |
| CVE-2024-57256 | medium | 6.8 | 2025.01-rc1 | per vulnerability databases |
| CVE-2024-57259 | medium | 6.8 | 2025.01-rc1 | per vulnerability databases |
| CVE-2025-45512 | medium | 6.5 | not stated | per vulnerability databases |
| CVE-2026-71972 | medium | 6.0 | not stated | per vulnerability databases |
| CVE-2019-11690 | medium | 5.9 | not stated | per vulnerability databases |
| CVE-2022-30552 | medium | 5.5 | not stated | per vulnerability databases |
| CVE-2026-71973 | medium | 5.2 | 2026.10-rc4 | per vulnerability databases |
| CVE-2026-71974 | medium | 4.3 | 2026.10-rc3 | per vulnerability databases |
| CVE-2024-57257 | low | 2.4 | 2025.01-rc1 | per vulnerability databases |
| CVE-2025-70291 | not rated | not rated | not stated | per vulnerability databases |
| CVE-2025-70292 | not rated | not rated | not stated | per vulnerability databases |
Which U-Boot version do I need to upgrade to?
Fixed in U-Boot 2022.07: 1 CVE of this version.
Fixed in U-Boot 2025.01-rc1: 6 CVEs of this version.
Fixed in U-Boot 2026.04: 4 CVEs of this version.
Fixed in U-Boot 2026.10-rc3: 2 CVEs of this version.
Fixed in U-Boot 2026.10-rc4: 1 CVE of this version.
Fixed in U-Boot 2026.10-rc5: 4 CVEs of this version.
No fix version stated: 35.
What changed against U-Boot 2019.01?
No CVE of 2019.01 dropped out in 2019.04.
No CVE was added in 2019.04.
What does the number mean for a device?
Counted are the CVEs public sources name for U-Boot version 2019.04 (NVD, OSV, Vendor advisories). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Licence notes of the sources: OSV: CC BY 4.0.
Questions
How many CVEs does U-Boot 2019.04 have?
As of 13 Nov 2026, 53 CVEs are known for U-Boot 2019.04, 21 critical and 18 high. 2026.04, the newest listed version, still carries 18 of them.
From which version are the CVEs of U-Boot 2019.04 fixed?
No newer listed version is free of all 53 CVEs. The "Fixed from" column names the fix version per CVE for this release line where a source states one.