← Vulnerability feed

Vulnerability record · CVE-2018-10864 · published 13 August 2018

CVE-2018-10864: Redhat certification uncontrolled resource consumption vulnerability

Redhat · Certification

An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.

6.2 CVSS 3.0 Medium EPSS 1.2% · top 32.2% CWE-400 · Uncontrolled resource consumption
6.2CVSS 3.0 base score, v2 5.0
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2018:2373 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10864 Issue TrackingVendor Advisory
https://access.redhat.com/errata/RHSA-2018:2373 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10864 Issue TrackingVendor Advisory

Track CVE-2018-10864 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-10870Redhat certification path traversal vulnerabilityredhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any fil…EPSS 6.1%9.1CVE-2018-10866Redhat certification missing authorization vulnerabilityIt was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated use…EPSS 1.0%9.1CVE-2018-10867Redhat certification vulnerabilityFiles are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file ac…EPSS 1.1%7.5CVE-2018-10863Redhat certification vulnerabilityIt was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer…EPSS 1.1%7.5CVE-2018-10865Redhat certification missing authorization vulnerabilityIt was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated use…EPSS 1.0%7.5CVE-2018-10868Redhat certification uncontrolled resource consumption vulnerabilityredhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user …EPSS 1.1%7.5CVE-2018-10869Redhat certification incorrect permission assignment vulnerabilityredhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file access…EPSS 2.7%5.3CVE-2019-3897Redhat certification vulnerabilityIt has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. R…EPSS 0.91%

Source: NIST National Vulnerability Database (record CVE-2018-10864), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.