CVE-2018-18385
Asciidoctor Infinite Loop vulnerability
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.5
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
CVE-2018-18385- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
CVE-2018-18385- Updated
- 2026-11-02
EUVDEUVD-2022-4946 No score
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
EUVD-2022-4946- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc9p-mjxm-j2wj
7.5
Asciidoctor Infinite Loop vulnerability
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
GHSA-qc9p-mjxm-j2wj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
7.5
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
CVE-2018-18385- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-18385
7.5
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
DEBIAN-CVE-2018-18385- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-qc9p-mjxm-j2wj
7.5
Asciidoctor Infinite Loop vulnerability
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
GHSA-qc9p-mjxm-j2wj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-18385
7.5
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
- Record
UBUNTU-CVE-2018-18385- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asciidoctorRubyGems |
before 1.5.8 | 1.5.8 |
asciidoctorDebian:12 |
before 1.5.8-1 | 1.5.8-1 |
asciidoctorDebian:13 |
before 1.5.8-1 | 1.5.8-1 |
asciidoctorDebian:14 |
before 1.5.8-1 | 1.5.8-1 |
asciidoctorRubyGems |
before 1.5.8, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 19 moreShow less0.0.60.0.70.0.90.1.00.1.10.1.20.1.30.1.41.5.01.5.11.5.21.5.31.5.41.5.51.5.61.5.6.11.5.6.21.5.71.5.7.1 |
1.5.8 |
asciidoctorUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.2-21.5.3-11.5.4-1 |
None known |
asciidoctorUbuntu:18.04:LTS |
All versions, plus listed versions 1.5.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-18385 is a high vulnerability (CVSS 7.5) in Asciidoctor, published October 16, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 83rd percentile. Fixed in asciidoctor 1.5.8.
References
github.com/asciidoctor/asciidoctor/issues/2888
nvd.nist.gov/vuln/detail/CVE-2018-18385
github.com/rubysec/ruby-advisory-db/blob/master/gems/asciidoctor/CVE-2018-18385.yml
github.com/advisories/GHSA-qc9p-mjxm-j2wj
security-tracker.debian.org/tracker/CVE-2018-18385
github.com/asciidoctor/asciidoctor
ubuntu.com/security/CVE-2018-18385
cve.org/CVERecord?id=CVE-2018-18385