CVE-2018-16949

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.

• CWE-400

• http://openafs.org/pages/security/OPENAFS-SA-2018-003.txtVendor Advisory
• http://www.securityfocus.com/bid/106375Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/09/msg00024.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4302Third Party Advisory
• http://openafs.org/pages/security/OPENAFS-SA-2018-003.txtVendor Advisory
• http://www.securityfocus.com/bid/106375Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/09/msg00024.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4302Third Party Advisory

Published

Sep 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16935Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16936Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1694IBM Jazz applications (IBM Rational Collaborative Lifecycle …5.9
• CVE-2018-16946LG LNB*, LND*, LNU*, and LNV* smart network camera devices h…
• CVE-2018-16947An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-16948An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-1695IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 install…7.3
• CVE-2018-16950Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remo…
• CVE-2018-16951xunfeng 0.2.0 allows command execution via CSRF because mass…
• CVE-2018-16952The Oracle WebCenter Interaction Portal 10.3.3 does not impl…
• CVE-2018-16953The AjaxView::DisplayResponse() function of the portalpages.…
• CVE-2018-16954An issue was discovered in Oracle WebCenter Interaction Port…