CVE-2018-16875

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-168765.3ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to le CVE-2018-168777.8A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker CVE-2018-168785.5A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes CVE-2018-168799.8Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for mess CVE-2018-16885.4IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerab CVE-2018-168807.0A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions,CVE-2018-168817.5A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptc CVE-2018-168828.8A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is CVE-2018-168835.5sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration par CVE-2018-168848.0A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_CVE-2018-168855.5A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and bu CVE-2018-168868.1etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control