{"id":"CVE-2016-20013","aliases":["EUVD-2016-3101","GHSA-7rf5-g36v-wpjh","ROOT-OS-UBUNTU-2204-CVE-2016-20013","UBUNTU-CVE-2016-20013"],"status":"published","title":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU...","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02174,"percentile":0.82428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2022-02-19T04:17:39Z","modified":"2026-10-15T05:15:04Z","fixes":[{"ecosystem":"Root:Ubuntu:22.04","package":"glibc","fixed_in":["2.35-0ubuntu3.15.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-glibc","fixed_in":["2.35-0ubuntu3.15.aikido.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35-0ubuntu3.15.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35-0ubuntu3.15.aikido.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2","2.19-0ubuntu6.15+esm3","2.19-0ubuntu6.15+esm4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.05+dfsg-6+deb7u3ubuntu1","3:4.05+dfsg-6+deb8u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6+dfsg-1ubuntu2","1:2.2.0+dfsg-1ubuntu1","1:2.2.0+dfsg-6ubuntu1","1:2.2.1+dfsg-1ubuntu3","1:2.2.2+dfsg-1ubuntu1","1:2.2.2+dfsg-1ubuntu1+esm1","1:2.2.2+dfsg-1ubuntu1+esm3","1:2.2.2+dfsg-1ubuntu1+esm4","1:2.2.2+dfsg-1ubuntu1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11","2.23-0ubuntu11.2","2.23-0ubuntu11.3","2.23-0ubuntu11.3+esm1","2.23-0ubuntu11.3+esm2","2.23-0ubuntu11.3+esm3","2.23-0ubuntu11.3+esm5","2.23-0ubuntu11.3+esm6","2.23-0ubuntu11.3+esm7","2.23-0ubuntu11.3+esm8","2.23-0ubuntu11.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.5-2","1.13.1-2","1.13.2-1","1.13.3-1","1.13.4-1","1.13.4-1ubuntu1","1.13.4-1ubuntu1.1","1.13.4-1ubuntu1.2","1.13.4-1ubuntu1.5","1.13.4-1ubuntu1.6","1.13.4-1ubuntu1.7","1.13.4-1ubuntu1.8","1.13.4-1ubuntu1.9","1.13.4-1ubuntu1.10","1.13.4-1ubuntu1.11","1.13.4-1ubuntu1.12","1.13.4-1ubuntu1.13","1.13.4-1ubuntu1.14","1.13.4-1ubuntu1.15","1.13.4-1ubuntu1.15+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.03+dfsg-8ubuntu2","3:6.03+dfsg-11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"syslinux-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.63+dfsg-2ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dietlibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.33~cvs20120325-6","0.33~cvs20120325-6+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.6+dfsg-1","1:2.4.7+dfsg-1","1:2.4.7+dfsg-2","1:2.4.7+dfsg-2ubuntu2","1:2.4.7+dfsg-2ubuntu2.1","1:2.4.7+dfsg-2ubuntu2.1+esm1","1:2.4.7+dfsg-2ubuntu2.1+esm2","1:2.4.7+dfsg-2ubuntu2.1+esm3","1:2.4.7+dfsg-2ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1","2.27-3ubuntu1.2","2.27-3ubuntu1.3","2.27-3ubuntu1.4","2.27-3ubuntu1.5","2.27-3ubuntu1.6","2.27-3ubuntu1.6+esm1","2.27-3ubuntu1.6+esm2","2.27-3ubuntu1.6+esm3","2.27-3ubuntu1.6+esm4","2.27-3ubuntu1.6+esm5","2.27-3ubuntu1.6+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.3-2ubuntu1","1.15.3-3ubuntu1","1.16.0-5ubuntu1","1.16.0-5ubuntu2","1.16.1-1ubuntu1","1.16.1-1ubuntu1.1","1.16.1-1ubuntu1.2","1.16.1-1ubuntu1.3","1.16.1-1ubuntu1.4","1.16.1-1ubuntu1.5","1.16.1-1ubuntu1.6","1.16.1-1ubuntu1.7","1.16.1-1ubuntu1.8","1.16.1-1ubuntu1.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.03+dfsg-14.1","3:6.03+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"syslinux-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.63+dfsg-2ubuntu9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dietlibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.34~cvs20160606-7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.0.7+dfsg-3","1:3.0.12+dfsg-1","1:3.0.12+dfsg-1ubuntu0.1~esm1","1:3.0.12+dfsg-1ubuntu0.1~esm2","1:3.0.12+dfsg-1ubuntu0.1~esm3","1:3.0.12+dfsg-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30-0ubuntu2","2.30-0ubuntu3","2.31-0ubuntu5","2.31-0ubuntu6","2.31-0ubuntu7","2.31-0ubuntu9","2.31-0ubuntu9.1","2.31-0ubuntu9.2","2.31-0ubuntu9.3","2.31-0ubuntu9.7","2.31-0ubuntu9.9","2.31-0ubuntu9.12","2.31-0ubuntu9.14","2.31-0ubuntu9.15","2.31-0ubuntu9.16","2.31-0ubuntu9.17","2.31-0ubuntu9.18","2.31-0ubuntu9.18+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-4ubuntu1","2.2.2-1","2.2.2-1ubuntu1","2.2.3-1.1ubuntu1","2.2.3-2","2.2.3-3","2.2.3-3ubuntu0.1","2.2.3-3ubuntu0.2","2.2.3-3ubuntu0.3","2.2.3-3ubuntu0.4","2.2.3-3ubuntu0.6","2.2.3-3ubuntu0.7","2.2.3-3ubuntu0.8","2.2.3-3ubuntu0.9","2.2.3-3ubuntu0.10","2.2.3-3ubuntu0.11","2.2.3-3ubuntu0.12","2.2.3-3ubuntu0.13","2.2.3-3ubuntu0.13+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.04~git20190206.bf6db5b4+dfsg1-1","3:6.04~git20190206.bf6db5b4+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"syslinux-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.63+dfsg-2ubuntu9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dietlibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.34~cvs20160606-10","0.34~cvs20160606-11","0.34~cvs20160606-12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1","1:4.0.17+dfsg-1ubuntu0.1~esm1","1:4.0.17+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dietlibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.34~cvs20160606-12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.34-0ubuntu3","2.35-0ubuntu1","2.35-0ubuntu3","2.35-0ubuntu3.1","2.35-0ubuntu3.3","2.35-0ubuntu3.4","2.35-0ubuntu3.5","2.35-0ubuntu3.6","2.35-0ubuntu3.7","2.35-0ubuntu3.8","2.35-0ubuntu3.9","2.35-0ubuntu3.10","2.35-0ubuntu3.11","2.35-0ubuntu3.12","2.35-0ubuntu3.13","2.35-0ubuntu3.14","2.35-0ubuntu3.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-2ubuntu4","2.5.2-4ubuntu1","2.5.2-4ubuntu3","2.5.2-4ubuntu4","2.6.1-1ubuntu3","2.6.3-1ubuntu3","2.6.3-1ubuntu3.1","2.6.3-1ubuntu3.2","2.6.3-1ubuntu3.3","2.6.3-1ubuntu3.4","2.6.3-1ubuntu3.5","2.6.3-1ubuntu3.6","2.6.3-1ubuntu3.8","2.6.3-1ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.04~git20190206.bf6db5b4+dfsg1-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.8+dfsg-1build1","1:5.0.14+dfsg-1","1:5.0.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dietlibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.34~cvs20160606-14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38-1ubuntu6","2.38-3ubuntu1","2.39-0ubuntu1","2.39-0ubuntu2","2.39-0ubuntu6","2.39-0ubuntu8","2.39-0ubuntu8.1","2.39-0ubuntu8.2","2.39-0ubuntu8.3","2.39-0ubuntu8.4","2.39-0ubuntu8.5","2.39-0ubuntu8.6","2.39-0ubuntu8.7","2.39-0ubuntu8.8","2.39-0ubuntu8.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.1-2ubuntu2","2.9.1-2ubuntu3","2.9.2-1ubuntu2","2.9.4-1ubuntu1","2.9.4-1.1ubuntu3","2.9.4-1.1ubuntu5","2.9.4-1.1ubuntu6","2.9.4-1.1ubuntu6.1","2.9.4-1.1ubuntu6.2","2.9.4-1.1ubuntu6.3","2.9.4-1.1ubuntu6.4","2.9.4-1.1ubuntu6.5","2.9.4-1.1ubuntu6.6","2.9.4-1.1ubuntu6.7","2.9.4-1.1ubuntu6.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.04~git20190206.bf6db5b4+dfsg1-3ubuntu2","3:6.04~git20190206.bf6db5b4+dfsg1-3ubuntu3"]}],"products":[{"vendor":"sha256crypt_project","product":"sha256crypt"},{"vendor":"sha512crypt_project","product":"sha512crypt"}],"references":[{"url":"https://twitter.com/solardiz/status/795601240151457793","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","report"]},{"url":"https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://akkadia.org/drepper/SHA-crypt.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013"},{"url":"https://github.com/advisories/GHSA-7rf5-g36v-wpjh"},{"url":"https://ubuntu.com/security/CVE-2016-20013","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-20013","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","status":"published","published":"2022-02-19T04:17:39Z","modified":"2024-08-06T03:47:34.906Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2016-3101","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","status":"published","published":"2022-02-19T04:17:39Z","modified":"2024-08-06T03:47:34Z","updated_at":"2026-11-03T02:22:21.756675Z"}],"ghsa":[{"id":"GHSA-7rf5-g36v-wpjh","title":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU...","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","status":"published","published":"2022-02-20T00:00:32Z","modified":"2023-02-03T05:06:23Z","cwes":["CWE-770"],"updated_at":"2026-11-02T14:53:53.812094Z"}],"nvd":[{"id":"CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","status":"published","published":"2022-02-19T05:15:09.413Z","modified":"2026-06-17T00:43:05.27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"UBUNTU-CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","status":"published","published":"2022-02-19T05:15:00Z","modified":"2026-09-10T16:30:20.617971846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2016-20013","title":"CVE-2016-20013 in glibc - Patched by Root","description":"Root has patched CVE-2016-20013 in the glibc package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-10-15T04:40:50Z","modified":"2026-10-15T05:15:04.371671774Z","updated_at":"2026-11-02T15:53:33.943322Z"}]}}