CVE-2018-20796
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix...
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
CVE-2018-20796- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-674
- Updated
- 2026-11-02
CVE List No score
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
CVE-2018-20796- Updated
- 2026-11-02
EUVDEUVD-2018-13339 No score
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
EUVD-2018-13339- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7x29-5q3f-f4x2
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix...
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
GHSA-7x29-5q3f-f4x2- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVBELL-CVE-2018-20796
CVE-2018-20796 does not affect BellSoft software
- Record
BELL-CVE-2018-20796- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
CVE-2018-20796- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2018-20796
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
DEBIAN-CVE-2018-20796- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-20796
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
- Record
UBUNTU-CVE-2018-20796- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2018-20796 No score
CVE-2018-20796 in glibc - Patched by Root
Root has patched CVE-2018-20796 in the glibc package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2018-20796- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2018-20796 No score
CVE-2018-20796 in glibc - Patched by Root
Root has patched CVE-2018-20796 in the glibc package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2018-20796- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glibcDebian:12 |
All versions, plus listed versions 2.36-10~02.36-92.36-9+deb12u12.36-9+deb12u102.36-9+deb12u11 Show 45 moreShow less2.36-9+deb12u122.36-9+deb12u132.36-9+deb12u142.36-9+deb12u22.36-9+deb12u32.36-9+deb12u42.36-9+deb12u52.36-9+deb12u62.36-9+deb12u72.36-9+deb12u82.36-9+deb12u92.36-9+loong642.37-12.37-102.37-112.37-122.37-132.37-142.37-152.37-15.12.37-15.1+sh42.37-15~deb13u12.37-162.37-172.37-182.37-192.37-22.37-32.37-42.37-52.37-62.37-72.37-82.37-92.38-12.38-102.38-112.38-122.38-12.12.38-132.38-142.38-15~02.38-15~12.38-22.38-3 |
None known |
glibcDebian:13 |
All versions, plus listed versions 2.41-122.41-12+deb13u12.41-12+deb13u22.41-12+deb13u32.41-12+deb13u4 Show 37 moreShow less2.41-13~hurd.02.41-13~hurd.12.42-12.42-102.42-112.42-122.42-12~hurd.12.42-132.42-142.42-14~hurd.12.42-152.42-15~hurd.12.42-162.42-172.42-22.42-32.42-42.42-52.42-62.42-72.42-82.42-8~hurd.12.42-8~hurd.22.42-92.43-12.43-22.43-32.43-3+m68k2.43-42.43-4+m68k2.43-52.43-62.43-72.43-7~hurd.12.44-12.44-22.44-3 |
None known |
glibcDebian:14 |
All versions, plus listed versions 2.41-122.41-13~hurd.02.41-13~hurd.12.42-12.42-10 Show 33 moreShow less2.42-112.42-122.42-12~hurd.12.42-132.42-142.42-14~hurd.12.42-152.42-15~hurd.12.42-162.42-172.42-22.42-32.42-42.42-52.42-62.42-72.42-82.42-8~hurd.12.42-8~hurd.22.42-92.43-12.43-22.43-32.43-3+m68k2.43-42.43-4+m68k2.43-52.43-62.43-72.43-7~hurd.12.44-12.44-22.44-3 |
None known |
glibcRoot:Debian:12 |
before 2.36-9+deb12u14.root.io.18 | 2.36-9+deb12u14.root.io.182.36-9+deb12u14.root.io.192.36-9+deb12u14.aikido.202.36-9+deb12u14.aikido.212.36-9+deb12u14.aikido.222.36-9+deb12u14.aikido.23 |
rootio-glibcRoot:Debian:12 |
before 2.36-9+deb12u14.root.io.18 | 2.36-9+deb12u14.root.io.182.36-9+deb12u14.root.io.192.36-9+deb12u14.aikido.202.36-9+deb12u14.aikido.212.36-9+deb12u14.aikido.222.36-9+deb12u14.aikido.23 |
glibcRoot:Debian:13 |
before 2.41-12+deb13u4.aikido.13 | 2.41-12+deb13u4.aikido.132.41-12+deb13u4.aikido.14 |
rootio-glibcRoot:Debian:13 |
before 2.41-12+deb13u4.aikido.13 | 2.41-12+deb13u4.aikido.132.41-12+deb13u4.aikido.14 |
eglibcUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.17-93ubuntu42.18-0ubuntu12.18-0ubuntu22.18-0ubuntu42.18-0ubuntu5 Show 24 moreShow less2.18-0ubuntu62.18-0ubuntu72.19-0ubuntu22.19-0ubuntu32.19-0ubuntu42.19-0ubuntu52.19-0ubuntu62.19-0ubuntu6.12.19-0ubuntu6.32.19-0ubuntu6.42.19-0ubuntu6.52.19-0ubuntu6.62.19-0ubuntu6.72.19-0ubuntu6.82.19-0ubuntu6.92.19-0ubuntu6.102.19-0ubuntu6.112.19-0ubuntu6.132.19-0ubuntu6.142.19-0ubuntu6.152.19-0ubuntu6.15+esm12.19-0ubuntu6.15+esm22.19-0ubuntu6.15+esm32.19-0ubuntu6.15+esm4 |
None known |
glibcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.21-0ubuntu42.21-0ubuntu52.21-0ubuntu62.23-0ubuntu12.23-0ubuntu2 Show 18 moreShow less2.23-0ubuntu32.23-0ubuntu42.23-0ubuntu52.23-0ubuntu62.23-0ubuntu72.23-0ubuntu92.23-0ubuntu102.23-0ubuntu112.23-0ubuntu11.22.23-0ubuntu11.32.23-0ubuntu11.3+esm12.23-0ubuntu11.3+esm22.23-0ubuntu11.3+esm32.23-0ubuntu11.3+esm52.23-0ubuntu11.3+esm62.23-0ubuntu11.3+esm72.23-0ubuntu11.3+esm82.23-0ubuntu11.3+esm9 |
None known |
glibcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.26-0ubuntu22.26-0ubuntu2.12.27-0ubuntu22.27-0ubuntu32.27-3ubuntu1 Show 11 moreShow less2.27-3ubuntu1.22.27-3ubuntu1.32.27-3ubuntu1.42.27-3ubuntu1.52.27-3ubuntu1.62.27-3ubuntu1.6+esm12.27-3ubuntu1.6+esm22.27-3ubuntu1.6+esm32.27-3ubuntu1.6+esm42.27-3ubuntu1.6+esm52.27-3ubuntu1.6+esm6 |
None known |
glibcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.30-0ubuntu22.30-0ubuntu32.31-0ubuntu52.31-0ubuntu62.31-0ubuntu7 Show 13 moreShow less2.31-0ubuntu92.31-0ubuntu9.12.31-0ubuntu9.22.31-0ubuntu9.32.31-0ubuntu9.72.31-0ubuntu9.92.31-0ubuntu9.122.31-0ubuntu9.142.31-0ubuntu9.152.31-0ubuntu9.162.31-0ubuntu9.172.31-0ubuntu9.182.31-0ubuntu9.18+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20796 is a high vulnerability (CVSS 7.5) in Gnu Glibc, published February 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.80%, the 93rd percentile. Fixed in glibc 2.36-9+deb12u14.root.io.18.
References
security.netapp.com/advisory/ntap-20190315-0002
lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
securityfocus.com/bid/107160
debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
nvd.nist.gov/vuln/detail/CVE-2018-20796
Show 6 moreShow less
Left out here: 86 versions. The JSON record has them.