CVE-2018-16848
OpenStack Mistral DoS
CVE-2018-16848 is a medium vulnerability (CVSS 6.5) in [unknown] Openstack-mistral, published June 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 67th percentile. Fixed in mistral 10.0.0.
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
CVE-2018-16848- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
CVE-2018-16848- Updated
- 2026-11-02
EUVDEUVD-2020-0112 No score
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
EUVD-2020-0112- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-443j-6p7g-6v4w
OpenStack Mistral DoS
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
GHSA-443j-6p7g-6v4w- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
CVE-2018-16848- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16848
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
DEBIAN-CVE-2018-16848- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-443j-6p7g-6v4w
OpenStack Mistral DoS
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
GHSA-443j-6p7g-6v4w- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-16848
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
UBUNTU-CVE-2018-16848- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVPYSEC-2020-240 No score
A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.
- Record
PYSEC-2020-240- Updated
- 2026-11-02
OSVUSN-7465-1 No score
mistral, python-mistral-lib vulnerabilities
It was discovered that Mistral incorrectly handled nested anchors in YAML files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16848)
Pierre Gaxatte discovered that Mistral incorrectly handled erroneous SSH private key filename commands. An attacker could possibly use this issue to expose sensitive information. (CVE-2018-16849)
It was discovered that Mistral incorrectly handled the permissions of sensitive log files. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3866)
- Record
USN-7465-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mistralPyPI |
before 10.0.0 | 10.0.0 |
mistralDebian:12 |
before 10.0.0~rc1-2 | 10.0.0~rc1-2 |
mistralDebian:13 |
before 10.0.0~rc1-2 | 10.0.0~rc1-2 |
mistralDebian:14 |
before 10.0.0~rc1-2 | 10.0.0~rc1-2 |
mistralPyPI |
before 10.0.0, plus listed versions 0.0.10.0.20.0.30.0.40.1 Show 45 moreShow less0.1.11.0.01.0.0.0b11.0.0.0b21.0.0.0b31.0.0.0rc11.0.0.0rc21.0.110.0.0.0b110.0.0.0b210.0.0.0b310.0.0.0rc12.0.02.0.0.0b12.0.0.0b22.0.0.0b32.0.0.0rc12.0.0.0rc22.0.0.0rc33.0.0.0b13.0.24.0.04.0.0.0b14.0.0.0b24.0.0.0b34.0.0.0rc14.0.0.0rc24.0.14.0.25.0.05.0.0.0b15.0.0.0b25.0.0.0b35.0.0.0rc15.1.05.2.05.2.15.2.25.2.35.2.45.2.55.2.65.2.75.2.86.0.0 |
10.0.0 |
mistralPyPI |
before 7.0.4, plus listed versions 0.0.10.0.20.0.30.0.40.1 Show 45 moreShow less0.1.11.0.01.0.0.0b11.0.0.0b21.0.0.0b31.0.0.0rc11.0.0.0rc21.0.12.0.02.0.0.0b12.0.0.0b22.0.0.0b32.0.0.0rc12.0.0.0rc22.0.0.0rc33.0.0.0b13.0.24.0.04.0.0.0b14.0.0.0b24.0.0.0b34.0.0.0rc14.0.0.0rc24.0.14.0.25.0.05.0.0.0b15.0.0.0b25.0.0.0b35.0.0.0rc15.1.05.2.05.2.15.2.25.2.35.2.45.2.55.2.65.2.75.2.86.0.06.0.0.0b16.0.0.0b26.0.0.0b36.0.0.0rc1 |
7.0.4 |
mistralUbuntu:Pro:18.04:LTS |
before 6.0.0-0ubuntu1.1+esm1, plus listed versions 5.0.0-0ubuntu16.0.0~b1-0ubuntu16.0.0~b1-0ubuntu26.0.0~b2-0ubuntu16.0.0~rc1-0ubuntu16.0.0-0ubuntu16.0.0-0ubuntu1.1 |
6.0.0-0ubuntu1.1+esm1 |
mistralUbuntu:Pro:16.04:LTS |
before 2.0.0-1ubuntu2+esm1, plus listed versions 1.0.0-11.0.0-42.0.0~b3-32.0.0~rc1-12.0.0~rc2-12.0.0-12.0.0-1ubuntu2 |
2.0.0-1ubuntu2+esm1 |
python-mistral-libUbuntu:Pro:18.04:LTS |
before 0.4.0-0ubuntu1+esm1, plus listed versions 0.2.0-0ubuntu20.3.2-0ubuntu10.3.3-0ubuntu10.4.0-0ubuntu1 |
0.4.0-0ubuntu1+esm1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=1645332
bugs.launchpad.net/mistral/+bug/1785657
nvd.nist.gov/vuln/detail/CVE-2018-16848
github.com/openstack/mistral/commit/eac23d9e774f658f9d4743c99aa2743eb104c3f9
Left out here: 46 versions. The JSON record has them.