CVE-2018-11773

CVE-2018-11773 describes an input validation vulnerability in Apache VCL versions 2.1 through 2.5, where improper validation of form input for block allocation allows for an attack against the underlying strtotime PHP function. This critical vulnerability, rated 9.8 CVSS, has a network attack vector, low complexity, and can lead to high impact on confidentiality, integrity, and availability. While the strtotime implementation was initially resistant to malicious attacks, all affected VCL systems should be upgraded to version 2.5.1 or later. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available, though the vulnerability has garnered significant community discussion with 10 mentions.