CVE-2018-20699 Denial of service in n/a
Attackers can cause denial of service in Docker Engine by providing large integer values for CPU or memory set parameters, leading to excessive memory consumption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20699?
CVE-2018-20699 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux Server, published on 12 Jan 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
Weakness: CWE-400
Which versions are affected by CVE-2018-20699?
It affects 2 products.
Linux distribution packages (9)
docker Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-client Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-common Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-debuginfo Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-logrotate Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-lvm-plugin Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-novolume-plugin Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-rhel-push-plugin Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
docker-v1.10-migrator Red Hat:rhel_extras_other:7 | All versions | 2:1.13.1-94.gitb2f74b2.el7 |
Products include Docker Engine, Redhat Enterprise Linux Server.
How do I fix CVE-2018-20699?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-20699 being exploited?
There is no known exploitation of CVE-2018-20699 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Server
- CVE-2026-34040 Moby: AuthZ plugin bypass with oversized request body
- CVE-2026-42306 Moby: Race condition in docker cp allows bind mount redirection to host path
- CVE-2026-33997 Moby: Off-by-one error in plugin privilege validation
- CVE-2026-41568 Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
Sources
Also known as AZL-44109, AZL-45387, DEBIAN-CVE-2018-20699, GHSA-m9q8-9m2h-84gh, MGASA-2019-0076, RHSA-2019:0487 and 1 more.