CVE-2018-3737
Regular Expression Denial of Service in sshpk
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- Record
CVE-2018-3737- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-770, CWE-185
- Updated
- 2026-11-02
CVE List No score
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- Record
CVE-2018-3737- Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2018-0353 No score
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- Record
EUVD-2018-0353- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2m39-62fm-q8r3
Regular Expression Denial of Service in sshpk
Versions of sshpk before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.
Recommendation
Update to version 1.13.2, 1.14.1 or later.
- Record
GHSA-2m39-62fm-q8r3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-185, CWE-770
- Updated
- 2026-11-02
OSV
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- Record
CVE-2018-3737- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- Record
DEBIAN-CVE-2018-3737- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-2m39-62fm-q8r3
Regular Expression Denial of Service in sshpk
Versions of sshpk before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.
Recommendation
Update to version 1.13.2, 1.14.1 or later.
- Record
GHSA-2m39-62fm-q8r3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-185, CWE-770
- Updated
- 2026-11-02
OSVRHSA-2020:2625
Red Hat Security Advisory: rh-nodejs8-nodejs security update
- Record
RHSA-2020:2625- CVSS 3.0
- 7.7 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- Record
UBUNTU-CVE-2018-3737- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sshpknpm |
before 1.13.2 | 1.13.2 |
node-sshpkDebian:12 |
before 1.13.1+dfsg-2 | 1.13.1+dfsg-2 |
node-sshpkDebian:13 |
before 1.13.1+dfsg-2 | 1.13.1+dfsg-2 |
node-sshpkDebian:14 |
before 1.13.1+dfsg-2 | 1.13.1+dfsg-2 |
rh-nodejs8-nodejsRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:8.17.0-2.el7 | 0:8.17.0-2.el7 |
rh-nodejs8-nodejs-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:8.17.0-2.el7 | 0:8.17.0-2.el7 |
rh-nodejs8-nodejs-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:8.17.0-2.el7 | 0:8.17.0-2.el7 |
rh-nodejs8-nodejs-docsRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:8.17.0-2.el7 | 0:8.17.0-2.el7 |
rh-nodejs8-npmRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:6.13.4-8.17.0.2.el7 | 0:6.13.4-8.17.0.2.el7 |
node-sshpkUbuntu:18.04:LTS |
All versions, plus listed versions 1.13.0+dfsg-11.13.1+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-3737 is a high vulnerability (CVSS 7.5) in Joyent Sshpk, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in sshpk 1.13.2.
References
hackerone.com/reports/319593
nvd.nist.gov/vuln/detail/CVE-2018-3737
github.com/advisories/GHSA-2m39-62fm-q8r3
npmjs.com/advisories/606
Show 36 moreShow less
security-tracker.debian.org/tracker/CVE-2018-3737
access.redhat.com/errata/RHSA-2020:2625
bugzilla.redhat.com/show_bug.cgi?id=1448380
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2625.json
cve.org/CVERecord?id=CVE-2017-18077
nodesecurity.io/advisories/612
ubuntu.com/security/CVE-2018-3737