CVE-2018-20796 describes an uncontrolled recursion vulnerability in the GNU C Library (glibc) through version 2.29, specifically within the check_dst_limits_calc_pos_1 function in posix/regexec.c. This flaw can be triggered by specially crafted regular expressions, affecting various GNU and NetApp products that utilize glibc. The vulnerability carries a CVSSv3 score of 7.5 (HIGH), indicating a high severity. It is remotely exploitable with low attack complexity, requiring no user interaction or privileges, and can lead to a denial of service (DoS) due to resource exhaustion. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.29CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:netapp:cloud_backup:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2018-20796
Aug 11, 2020In the GNU C Library (aka glibc or libc6) through 2.29 check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Feb 12, 2019glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
Jan 20, 2019