CVE-2018-21245

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

9.1 CriticalFix available

CVE-2018-21245 is a critical vulnerability (CVSS 9.1) in Apsis Pound, published June 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in pound 2.8-2.

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.13%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 9.1

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: CVE-2018-21245
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness: CWE-444
Updated: 2026-11-02

CVE List No score

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: CVE-2018-21245
Updated: 2026-11-02

EUVDEUVD-2018-13761 No score

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: EUVD-2018-13761
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r344-4jmp-54g4 No score

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: GHSA-r344-4jmp-54g4
Updated: 2026-11-02

OSV 9.1

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: CVE-2018-21245
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-21245 9.1

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: DEBIAN-CVE-2018-21245
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-21245 9.1

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

Record: UBUNTU-CVE-2018-21245
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11190-1 No score

pound-2.8-3.9 on GA media

These are all security issues fixed in the pound-2.8-3.9 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11190-1
Updated: 2026-11-02

OSVUSN-4702-1 No score

pound vulnerabilities

It was discovered that Pound incorrectly handled certain HTTP requests A remote attacker could use it to retrieve some sensitive information. (CVE-2016-10711, CVE-2018-21245)

Record: USN-4702-1
Updated: 2026-11-02

Affected products

apsis pound

Affected packages

Affected packages
Package	Affected	Fixed
`pound` Debian:13	before 2.8-2	2.8-2
`pound` Debian:14	before 2.8-2	2.8-2
`pound` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 2.6-22.6-32.6-3ubuntu0.1~esm1	None known
`pound` Ubuntu:16.04:LTS	before 2.6-6.1ubuntu0.1, plus listed versions 2.6-6.1	2.6-6.1ubuntu0.1
`pound` openSUSE:Tumbleweed	before 2.8-3.9	2.8-3.9

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less