CVE-2018-16865

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

• CWE-770
• CWE-770

• http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/May/21Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/05/10/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/07/20/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/106525Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0049Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0204Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0271Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0342Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0361Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2402Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865Issue Tracking, Patch
• https://lists.debian.org/debian-lts-announce/2019/01/msg00016.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/May/25Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201903-07Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190117-0001/Third Party Advisory
• https://usn.ubuntu.com/3855-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4367Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
• https://www.qualys.com/2019/01/09/system-down/system-down.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/May/21Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/05/10/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/07/20/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/106525Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0049Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0204Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0271Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0342Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0361Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2402Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865Issue Tracking, Patch
• https://lists.debian.org/debian-lts-announce/2019/01/msg00016.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/May/25Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201903-07Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190117-0001/Third Party Advisory
• https://usn.ubuntu.com/3855-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4367Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
• https://www.qualys.com/2019/01/09/system-down/system-down.txtExploit, Third Party Advisory

Published

Jan 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1686IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable …5.4
• CVE-2018-16860A flaw was found in samba's Heimdal KDC implementation, vers…7.5
• CVE-2018-16861A cross-site scripting (XSS) flaw was found in the foreman c…7.6
• CVE-2018-16862A security flaw was found in the Linux kernel in a way that …5.3
• CVE-2018-16863It was found that RHSA-2018:2918 did not fully fix CVE-2018-…7.3
• CVE-2018-16864An allocation of memory without limits, that could result in…7.8
• CVE-2018-16866An out of bounds read was discovered in systemd-journald in …3.3
• CVE-2018-16867A flaw was found in qemu Media Transfer Protocol (MTP) befor…7.8
• CVE-2018-16868A Bleichenbacher type side-channel based padding oracle atta…5.6
• CVE-2018-16869A Bleichenbacher type side-channel based padding oracle atta…5.7
• CVE-2018-16870It was found that wolfssl before 3.15.7 is vulnerable to a n…
• CVE-2018-16871A flaw was found in the Linux kernel's NFS implementation, a…7.5