CVE-2018-16789

CVE-2018-16789 describes a denial-of-service vulnerability in shellinabox through version 2.20, affecting the libhttp/url.c component. An attacker can exploit a flaw in the HTTP request parsing logic by sending a specially crafted multipart/form-data HTTP request. This forces the shellinaboxd service into an infinite loop, consuming all available CPU resources and rendering the service unavailable. The vulnerability has a CVSSv3 score of 7.5 (High), indicating a high severity due to its network-based attack vector, low attack complexity, and high impact on availability. There is no impact on confidentiality or integrity. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or attention.