CVE-2018-16789

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

• CWE-835

• http://packetstormsecurity.com/files/149978/Shell-In-A-Box-2.2.0-Denial-Of-Service.htmlExploit, Patch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Oct/50Exploit, Mailing List, Patch, Third Party Advisory
• https://code.google.com/archive/p/shellinabox/issuesThird Party Advisory
• https://github.com/shellinabox/shellinabox/commit/4f0ecc31ac6f985e0dd3f5a52cbfc0e9251f6361Patch, Third Party Advisory
• http://packetstormsecurity.com/files/149978/Shell-In-A-Box-2.2.0-Denial-Of-Service.htmlExploit, Patch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Oct/50Exploit, Mailing List, Patch, Third Party Advisory
• https://code.google.com/archive/p/shellinabox/issuesThird Party Advisory
• https://github.com/shellinabox/shellinabox/commit/4f0ecc31ac6f985e0dd3f5a52cbfc0e9251f6361Patch, Third Party Advisory

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16780Complete Responsive CMS Blog through 2018-05-20 has XSS via …
• CVE-2018-16781ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attacke…
• CVE-2018-16782libimageworsener.a in ImageWorsener 1.3.2 has a buffer overf…
• CVE-2018-16784DedeCMS 5.7 SP2 allows XML injection, and resultant remote c…
• CVE-2018-16785XML injection vulnerability exists in the file of DedeCMS V5…
• CVE-2018-16786DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in …
• CVE-2018-1679IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2…5.3
• CVE-2018-16790_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, a…
• CVE-2018-16791In SolarWinds SFTP/SCP Server through 2018-09-10, the config…
• CVE-2018-16792SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable …9.1
• CVE-2018-16793Rollup 18 for Microsoft Exchange Server 2010 SP3 and previou…
• CVE-2018-16794Microsoft ADFS 4.0 Windows Server 2016 and previous (Active …