CVE-2026-18798 (GCVE-0-2026-18798)

Vulnerability from cvelistv5 – Published: 2026-08-25 12:59 – Updated: 2026-08-25 14:15
VLAI
Title
QUIC Server May Trigger Double Free When Processing INITIAL Packet
Summary
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:15 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
OpenSSL OpenSSL Affected: 4.0.0 , < 4.0.2 (semver)
Affected: 3.6.0 , < 3.6.4 (semver)
Affected: 3.5.0 , < 3.5.8 (semver)
guessed Create a notification for this product.
Date Public
2026-08-25 11:36
Credits
Fuzz0x (ZKSC Institute of Security Research) Emilio Galle Feng Xue (ThreatBoon) Alexandr Nedvedicky
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-18798",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T14:15:00.501697Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T14:15:04.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.2",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.4",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.8",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Fuzz0x (ZKSC Institute of Security Research)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Emilio Galle"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Feng Xue (ThreatBoon)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandr Nedvedicky"
        }
      ],
      "datePublic": "2026-08-25T11:36:16.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\u003cbr\u003ewhen channel creation fails for initial packet.\u003cbr\u003e\u003cbr\u003eImpact summary: Double free leads to heap corruption, which typically results in \u003cbr\u003etermination of QUIC server process, leading to Denial of Service. There is so\u003cbr\u003efar no evidence that this double free is exploitable for remote code execution,\u003cbr\u003ethus it is considered highly improbable.\u003cbr\u003e\u003cbr\u003eCWE: CWE-415: Double Free\u003cbr\u003e\u003cbr\u003eDescription: In order to validate initial packet, OpenSSL QUIC stack default\u003cbr\u003epacket handler (port_default_packet_handler()) creates a so-called QRX object.\u003cbr\u003eIf the initial packet validates successfully with QRX object, the default packet\u003cbr\u003ehandler proceeds to channel (connection object) creation. The QRX object used\u003cbr\u003efor packet validation is passed to port_bind_channel(), so it becomes part of\u003cbr\u003ethe newly created connection. If port_bind_channel() fails, then it also frees\u003cbr\u003ethe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\u003cbr\u003edetects the failure and proceeds to the error branch, where the same QRX object is\u003cbr\u003efreed for the second time.\u003cbr\u003e\u003cbr\u003eThe failure in port_bind_channel() function can be induced with a relatively\u003cbr\u003elow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\u003cbr\u003ecarries DCID (destination connection ID) which is shorter than 8 bytes, then\u003cbr\u003eport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\u003cbr\u003edetects that the DCID has invalid length.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eThe FIPS module is not affected, as the QUIC implementation is outside of\u003cbr\u003ethe OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T12:59:04.715Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        },
        {
          "name": "4.0.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4"
        },
        {
          "name": "3.6.4 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af"
        },
        {
          "name": "3.5.8 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-18798",
    "datePublished": "2026-08-25T12:59:04.715Z",
    "dateReserved": "2026-08-04T09:45:25.371Z",
    "dateUpdated": "2026-08-25T14:15:04.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-18798",
      "date": "2026-08-26",
      "epss": "0.01481",
      "percentile": "0.72012"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-18798\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2026-08-25T13:17:49.813\",\"lastModified\":\"2026-08-25T15:16:31.207\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\\nwhen channel creation fails for initial packet.\\n\\nImpact summary: Double free leads to heap corruption, which typically results in \\ntermination of QUIC server process, leading to Denial of Service. There is so\\nfar no evidence that this double free is exploitable for remote code execution,\\nthus it is considered highly improbable.\\n\\nCWE: CWE-415: Double Free\\n\\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\\nIf the initial packet validates successfully with QRX object, the default packet\\nhandler proceeds to channel (connection object) creation. The QRX object used\\nfor packet validation is passed to port_bind_channel(), so it becomes part of\\nthe newly created connection. If port_bind_channel() fails, then it also frees\\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\\ndetects the failure and proceeds to the error branch, where the same QRX object is\\nfreed for the second time.\\n\\nThe failure in port_bind_channel() function can be induced with a relatively\\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\\ndetects that the DCID has invalid length.\\n\\nFIPS impact: no\\nThe FIPS module is not affected, as the QUIC implementation is outside of\\nthe OpenSSL FIPS module boundary.\"}],\"affected\":[{\"source\":\"openssl-security@openssl.org\",\"affectedData\":[{\"vendor\":\"OpenSSL\",\"product\":\"OpenSSL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.6.0\",\"lessThan\":\"3.6.4\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-25T14:15:00.501697Z\",\"id\":\"CVE-2026-18798\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://openssl-library.org/news/secadv/20260825.txt\",\"source\":\"openssl-security@openssl.org\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-26T16:36:37+00:00",
      "cve": "CVE-2026-18798",
      "id": "CVE-2026-18798",
      "initial_release_date": "2026-08-25T00:00:00+00:00",
      "product_status:fixed": "6",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "65",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: QUIC server may trigger double free when processing INITIAL packet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18798.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18798\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T14:15:00.501697Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T14:14:52.139Z\"}}], \"cna\": {\"title\": \"QUIC Server May Trigger Double Free When Processing INITIAL Packet\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Fuzz0x (ZKSC Institute of Security Research)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Emilio Galle\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Feng Xue (ThreatBoon)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Alexandr Nedvedicky\"}], \"metrics\": [{\"other\": {\"type\": \"https://openssl-library.org/policies/general/security-policy/\", \"content\": {\"text\": \"Moderate\"}}, \"format\": \"other\"}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"lessThan\": \"3.6.4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.8\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-08-25T11:36:16.000Z\", \"references\": [{\"url\": \"https://openssl-library.org/news/secadv/20260825.txt\", \"name\": \"OpenSSL Advisory\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4\", \"name\": \"4.0.2 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af\", \"name\": \"3.6.4 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c\", \"name\": \"3.5.8 git commit\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\\nwhen channel creation fails for initial packet.\\n\\nImpact summary: Double free leads to heap corruption, which typically results in \\ntermination of QUIC server process, leading to Denial of Service. There is so\\nfar no evidence that this double free is exploitable for remote code execution,\\nthus it is considered highly improbable.\\n\\nCWE: CWE-415: Double Free\\n\\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\\nIf the initial packet validates successfully with QRX object, the default packet\\nhandler proceeds to channel (connection object) creation. The QRX object used\\nfor packet validation is passed to port_bind_channel(), so it becomes part of\\nthe newly created connection. If port_bind_channel() fails, then it also frees\\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\\ndetects the failure and proceeds to the error branch, where the same QRX object is\\nfreed for the second time.\\n\\nThe failure in port_bind_channel() function can be induced with a relatively\\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\\ndetects that the DCID has invalid length.\\n\\nFIPS impact: no\\nThe FIPS module is not affected, as the QUIC implementation is outside of\\nthe OpenSSL FIPS module boundary.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\u003cbr\u003ewhen channel creation fails for initial packet.\u003cbr\u003e\u003cbr\u003eImpact summary: Double free leads to heap corruption, which typically results in \u003cbr\u003etermination of QUIC server process, leading to Denial of Service. There is so\u003cbr\u003efar no evidence that this double free is exploitable for remote code execution,\u003cbr\u003ethus it is considered highly improbable.\u003cbr\u003e\u003cbr\u003eCWE: CWE-415: Double Free\u003cbr\u003e\u003cbr\u003eDescription: In order to validate initial packet, OpenSSL QUIC stack default\u003cbr\u003epacket handler (port_default_packet_handler()) creates a so-called QRX object.\u003cbr\u003eIf the initial packet validates successfully with QRX object, the default packet\u003cbr\u003ehandler proceeds to channel (connection object) creation. The QRX object used\u003cbr\u003efor packet validation is passed to port_bind_channel(), so it becomes part of\u003cbr\u003ethe newly created connection. If port_bind_channel() fails, then it also frees\u003cbr\u003ethe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\u003cbr\u003edetects the failure and proceeds to the error branch, where the same QRX object is\u003cbr\u003efreed for the second time.\u003cbr\u003e\u003cbr\u003eThe failure in port_bind_channel() function can be induced with a relatively\u003cbr\u003elow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\u003cbr\u003ecarries DCID (destination connection ID) which is shorter than 8 bytes, then\u003cbr\u003eport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\u003cbr\u003edetects that the DCID has invalid length.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eThe FIPS module is not affected, as the QUIC implementation is outside of\u003cbr\u003ethe OpenSSL FIPS module boundary.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-415\", \"description\": \"CWE-415 Double Free\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2026-08-25T12:59:04.715Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-18798\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T14:15:04.879Z\", \"dateReserved\": \"2026-08-04T09:45:25.371Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2026-08-25T12:59:04.715Z\", \"assignerShortName\": \"openssl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.