CVE-2018-6003

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1...

7.5 HighFix available

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.83%Up 1.6 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: CVE-2018-6003
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-674
Updated: 2026-11-02

CVE List No score

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: CVE-2018-6003
Updated: 2026-11-02

EUVDEUVD-2018-17768 No score

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: EUVD-2018-17768
Updated: 2026-11-03

GitHub AdvisoriesGHSA-834w-g79f-wrqv 7.5

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1...

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: GHSA-834w-g79f-wrqv
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSVALPINE-CVE-2018-6003 7.5

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: ALPINE-CVE-2018-6003
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2018-6003 7.5

CVE-2018-6003 does not affect BellSoft software

Record: BELL-CVE-2018-6003
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSV 7.5

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: CVE-2018-6003
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-6003 7.5

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: DEBIAN-CVE-2018-6003
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-6003 7.5

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Record: UBUNTU-CVE-2018-6003
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1778604436 No score

libtasn1: Fix of CVE-2018-6003

CVE-2018-6003: Restrict recursion depth in _asn1_decode_simple_ber() to prevent stack exhaustion DoS via crafted indefinite-length BER input.

Record: CLSA-2026-1778604436
Updated: 2026-11-02

OSVCLSA-2026-1782730098 No score

libtasn1: Fix of CVE-2021-46848

CVE-2018-6003: Restrict recursion depth in _asn1_decode_simple_ber() to prevent stack exhaustion DoS via crafted indefinite-length BER input.

Record: CLSA-2026-1782730098
Updated: 2026-11-02

OSVCLSA-2026-1792179539 No score

libtasn1: Fix of CVE-2021-46848

CVE-2018-6003: Restrict recursion depth in _asn1_decode_simple_ber() to prevent stack exhaustion DoS via crafted indefinite-length BER input.

Record: CLSA-2026-1792179539
Updated: 2026-11-02

OSVMGASA-2018-0121 No score

Updated libtasn1 packages fix security vulnerability

It was discovered that Libtasn1 incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service (CVE-2017-10790).

It was discovered that Libtasn1 incorrectly handled certain inputs. An attacker could possibly use this to cause Libtasn1 to hang, resulting in a denial of service (CVE-2018-6003).

Record: MGASA-2018-0121
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11001-1 No score

libtasn1-6-32bit-4.17.0-1.2 on GA media

These are all security issues fixed in the libtasn1-6-32bit-4.17.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11001-1
Updated: 2026-11-02

OSVSUSE-SU-2018:0295-1 No score

Security update for libtasn1

This update for libtasn1 fixes one issue.

This security issue was fixed:

CVE-2018-6003: Prevent a stack exhaustion in _asn1_decode_simple_ber (lib/decoding.c) when decoding BER encoded structure allowed for DoS (bsc#1076832).

Record: SUSE-SU-2018:0295-1
Updated: 2026-11-02

OSVUSN-3547-1 No score

libtasn1-6 vulnerabilities

It was discovered that Libtasn1 incorrectly handled certain inputs. An attacker could possibly use this to cause Libtasn1 to hang, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6003)

Record: USN-3547-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libtasn1` Alpine:v3.10	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.11	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.12	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.13	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.14	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.15	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.16	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.17	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.18	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.19	before 4.13-r0	4.13-r0

Show 33 moreShow less

Affected packages
Package	Affected	Fixed
`libtasn1` Alpine:v3.20	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.21	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.22	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.23	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.24	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.4	before 4.8-r3	4.8-r3
`libtasn1` Alpine:v3.5	before 4.9-r3	4.9-r3
`libtasn1` Alpine:v3.6	before 4.10-r3	4.10-r3
`libtasn1` Alpine:v3.7	before 4.12-r3	4.12-r3
`libtasn1` Alpine:v3.8	before 4.13-r0	4.13-r0
`libtasn1` Alpine:v3.9	before 4.13-r0	4.13-r0
`libtasn1` TuxCare:CentOS:7	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-devel` TuxCare:CentOS:7	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-tools` TuxCare:CentOS:7	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1` TuxCare:OracleLinux:7 From an advisory covering 2 CVEs	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-devel` TuxCare:OracleLinux:7 From an advisory covering 2 CVEs	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-tools` TuxCare:OracleLinux:7 From an advisory covering 2 CVEs	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1` TuxCare:RHEL:7 From an advisory covering 2 CVEs	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-devel` TuxCare:RHEL:7 From an advisory covering 2 CVEs	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-tools` TuxCare:RHEL:7 From an advisory covering 2 CVEs	before 4.10-1.el7.tuxcare.els2	4.10-1.el7.tuxcare.els2
`libtasn1-6` Debian:12	before 4.13-2	4.13-2
`libtasn1-6` Debian:13	before 4.13-2	4.13-2
`libtasn1-6` Debian:14	before 4.13-2	4.13-2
`libtasn1-6` Debian:9 From an advisory covering 2 CVEs	before 4.10-1.1+deb9u1, plus listed versions 4.10-1.1	4.10-1.1+deb9u1
`libtasn1` Mageia:6 From an advisory covering 2 CVEs	before 4.13-1.mga6	4.13-1.mga6
`libtasn1` SUSE:Linux Enterprise Desktop 12 SP3	before 4.9-3.5.1	4.9-3.5.1
`libtasn1` SUSE:Linux Enterprise Software Development Kit 12 SP3	before 4.9-3.5.1	4.9-3.5.1
`libtasn1` SUSE:Linux Enterprise Server 12 SP3	before 4.9-3.5.1	4.9-3.5.1
`libtasn1` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	before 4.9-3.5.1	4.9-3.5.1
`libtasn1-6` Ubuntu:16.04:LTS	before 4.7-3ubuntu0.16.04.3, plus listed versions 4.5-24.7-24.7-34.7-3ubuntu0.16.04.14.7-3ubuntu0.16.04.2	4.7-3ubuntu0.16.04.3
`libtasn1-6` Ubuntu:14.04:LTS From an advisory covering 2 CVEs	before 3.4-3ubuntu0.6, plus listed versions 3.3-23.4-23.4-33.4-3ubuntu0.13.4-3ubuntu0.23.4-3ubuntu0.33.4-3ubuntu0.43.4-3ubuntu0.5	3.4-3ubuntu0.6
`libtasn1-6` Ubuntu:16.04:LTS From an advisory covering 2 CVEs	before 4.7-3ubuntu0.16.04.3, plus listed versions 4.5-24.7-24.7-34.7-3ubuntu0.16.04.14.7-3ubuntu0.16.04.2	4.7-3ubuntu0.16.04.3
`libtasn1` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 4.17.0-1.2	4.17.0-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6003 is a high vulnerability (CVSS 7.5) in Gnu Libtasn1, published January 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in libtasn1 4.13-r0.

References

Show 23 moreShow less