Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-1000120

37
FAUCET Score

CVE-2018-1000120 describes a critical buffer overflow vulnerability in curl versions 7.12.3 through 7.58.0, specifically within its FTP URL handling. This flaw affects products from vendors like Canonical, Debian, Haxx, Oracle, and Red Hat. With a CVSS score of 9.8 (CRITICAL), it can be exploited remotely with low complexity, potentially leading to denial of service or arbitrary code execution. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
7.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
12.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
11.82%
Probability of exploitation in next 30 days
EPSS Percentile
95.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.1182 is in the 91st percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

jitsipatch availablevia llm_extracted
Fixed in: 7.58.0
View patch
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services Apache HTTP Server 2.4.29 SP2Fixed in: jbcs-httpd24-curl
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: nss-pem-0:1.0.3-5.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: curl-0:7.29.0-42.el7_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Telco Extended Update SupportFixed in: curl-0:7.29.0-42.el7_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsFixed in: curl-0:7.29.0-42.el7_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.5 Extended Update SupportFixed in: curl-0:7.29.0-46.el7_5.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-curl-0:7.61.1-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-httpd-0:2.4.34-7.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-nghttp2-0:1.7.1-7.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-curl-0:7.61.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-httpd-0:2.4.34-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-nghttp2-0:1.7.1-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: httpd24-curl-0:7.61.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: httpd24-httpd-0:2.4.34-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: httpd24-nghttp2-0:1.7.1-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-curl-0:7.61.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-httpd-0:2.4.34-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-nghttp2-0:1.7.1-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-curl-0:7.61.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-httpd-0:2.4.34-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-nghttp2-0:1.7.1-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: curl-0:7.29.0-51.el7
View patch
sierra_wirelesspatch availablevia llm_extracted
Fixed in: 7.58.0
View patch
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 2Fixed in: curl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: curl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: curl
redhatend of lifevia redhat_api
Product: .NET Core 2.1 on Red Hat Enterprise LinuxFixed in: rh-dotnet21-curl

Vendor Advisories (4)

nugetGHSA-674j-7m97-j2p9critical

curl FTP path confusion leads to NIL byte out of bounds write

May 14, 2022
redhatCVE-2018-1000120Moderate

curl: FTP path trickery leads to NIL byte out of bounds write

Mar 14, 2018
sierra_wirelessllm-sierra_wireless-21ec6b5924f34181HIGH

FTP path trickery leads to NIL byte out of bounds write

Mar 14, 2018
jitsillm-jitsi-d48f680455241902HIGH

FTP path trickery leads to NIL byte out of bounds write

Mar 14, 2018

References

access.redhat.com / errata/RHBA-2019:0327
Third Party Advisory
access.redhat.com / errata/RHSA-2018:3157
Third Party Advisory
access.redhat.com / errata/RHSA-2018:3558
Third Party Advisory
access.redhat.com / errata/RHSA-2019:1543
access.redhat.com / errata/RHSA-2020:0544
access.redhat.com / errata/RHSA-2020:0594
curl.haxx.se / docs/adv_2018-9cd6.html
Vendor Advisory
lists.debian.org / debian-lts-announce/2018/03/msg00012.html
Mailing ListThird Party Advisory
usn.ubuntu.com / 3598-1
Third Party Advisory
usn.ubuntu.com / 3598-2
Third Party Advisory
debian.org / security/2018/dsa-4136
Third Party Advisory
oracle.com / technetwork/security-advisory/cpujan2019-5072801.html
PatchThird Party Advisory
oracle.com / technetwork/security-advisory/cpujul2019-5072835.html
oracle.com / technetwork/security-advisory/cpuoct2019-5072832.html
oracle.com / technetwork/security-advisory/cpujul2018-4258247.html
Patch
oracle.com / technetwork/security-advisory/cpuoct2018-4428296.html
Patch
securityfocus.com / bid/103414
Third Party AdvisoryVDB Entry
securitytracker.com / id/1040531
Third Party AdvisoryVDB Entry