CVE-2018-6532 Denial of service in n/a
Attackers can exhaust server memory via crafted requests, triggering the OOM killer and causing denial of service in Icinga.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-6532?
CVE-2018-6532 is a high-severity denial of service vulnerability in n/a, published on 27 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer.
Weakness: CWE-400
Which versions are affected by CVE-2018-6532?
It affects 1 product.
Products include Icinga Icinga.
How do I fix CVE-2018-6532?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-6532 being exploited?
There is no known exploitation of CVE-2018-6532 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-48057 Icinga 2 certificate renewal might incorrectly renew an invalid certificate
- CVE-2020-29663 Security feature bypass in n/a
- CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery
- CVE-2018-6535 Information disclosure in n/a
- CVE-2020-14004 Path traversal in n/a
Sources
Also known as DEBIAN-CVE-2018-6532, GHSA-7vvj-647q-jgx2, UBUNTU-CVE-2018-6532.