CVE-2018-21232

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

5.5 MediumFix available

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.47%Up 0.6 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: CVE-2018-21232
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-674
Updated: 2026-11-02

CVE List No score

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: CVE-2018-21232
Updated: 2026-11-02

EUVDEUVD-2018-13750 No score

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: EUVD-2018-13750
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pgr8-gpgg-9j5m No score

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: GHSA-pgr8-gpgg-9j5m
Updated: 2026-11-02

OSVAZL-7337 5.5

CVE-2018-21232 affecting package re2c for versions less than 2.0-1

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: AZL-7337
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.5

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: CVE-2018-21232
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVDEBIAN-CVE-2018-21232 5.5

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: DEBIAN-CVE-2018-21232
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVUBUNTU-CVE-2018-21232 5.5

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

Record: UBUNTU-CVE-2018-21232
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2021-0299 No score

Updated re2c package fixes a security vulnerability

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags (CVE-2018-21232).

Record: MGASA-2021-0299
Updated: 2026-11-02

OSVSUSE-SU-2023:3353-1 No score

Security update for re2c

This update for re2c fixes the following issues:

CVE-2018-21232: Fixed excess stack consumption due to uncontrolled recursion in find_fixed_tags (bsc#1170890).

Record: SUSE-SU-2023:3353-1
Updated: 2026-11-02

Affected products

re2c

Affected packages

Affected packages
Package	Affected	Fixed
`re2c` Azure Linux:2	before 2.0-1	2.0-1
`re2c` Debian:12	All versions, plus listed versions 3.0-23.1-14.0.1-14.0.2-14.1-1 Show 7 moreShow less 4.2-14.3-14.3-24.3.1-14.4-14.5.1-14.6-1	None known
`re2c` Debian:13	before 3.1-1	3.1-1
`re2c` Debian:14	before 3.1-1	3.1-1
`re2c` Mageia:7	before 2.0.3-1.mga7	2.0.3-1.mga7
`re2c` SUSE:Linux Enterprise Module for Basesystem 15 SP4	before 1.0.3-150000.3.3.1	1.0.3-150000.3.3.1
`re2c` SUSE:Linux Enterprise Module for Basesystem 15 SP5	before 1.0.3-150000.3.3.1	1.0.3-150000.3.3.1
`re2c` SUSE:Manager Proxy 4.2	before 1.0.3-150000.3.3.1	1.0.3-150000.3.3.1
`re2c` SUSE:Manager Server 4.2	before 1.0.3-150000.3.3.1	1.0.3-150000.3.3.1
`re2c` openSUSE:Leap 15.4	before 1.0.3-150000.3.3.1	1.0.3-150000.3.3.1

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`re2c` openSUSE:Leap 15.5	before 1.0.3-150000.3.3.1	1.0.3-150000.3.3.1
`re2c` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.1-1	None known
`re2c` Ubuntu:20.04:LTS	All versions, plus listed versions 1.2.1-11.3-11.3-1build11.3-1ubuntu0.1	None known
`re2c` Ubuntu:22.04:LTS	All versions, plus listed versions 2.0.3-1build12.2-13.0-1	None known
`re2c` Ubuntu:24.04:LTS	All versions, plus listed versions 3.1-13.1-1build1	None known
`re2c` Ubuntu:25.10	All versions, plus listed versions 4.1-14.3-2	None known
`re2c` Ubuntu:26.04:LTS	All versions, plus listed versions 4.3-24.3.1-14.4-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-21232 is a medium vulnerability (CVSS 5.5) in Re2c, published April 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in re2c 2.0-1.

References

Show 7 moreShow less