CVE-2018-13844 Denial of service in n/a
A memory leak in HTSlib's fai_read function can lead to resource exhaustion, though the issue is disputed as a user responsibility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-13844?
CVE-2018-13844 is a high-severity denial of service vulnerability in n/a, published on 10 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue has been found in HTSlib 1.8. It is a memory leak in fai_read in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by fai_load() in their own code
Weakness: CWE-401
Which versions are affected by CVE-2018-13844?
It affects 1 product.
Products include Htslib Htslib.
How do I fix CVE-2018-13844?
No fix published yet.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-13844 being exploited?
There is no known exploitation of CVE-2018-13844 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-13845 Memory corruption in n/a
- CVE-2017-1000206 Memory corruption in n/a
- CVE-2026-31962 HTSlib CRAM reader has heap buffer overflow due to improper validation of input
- CVE-2026-31963 HTSlib CRAM reader has heap buffer overflow due to improper validation of input
- CVE-2026-31968 HTSlib CRAM decoder vulnerable to buffer overflow
Sources
Also known as DEBIAN-CVE-2018-13844, GHSA-2f5j-prvf-gf42.