Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2018-18385

Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2018-18385
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 10:44 UTC · Revision 1

Source evidence

CVE-2018-18385

core-osv · Original source

Published 16 Oct 2018, 16:50 UTC

Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.

osv:CVE-2018-18385
Complete source record
{
  "id": "4d22b1fa8812a626f8a97332dbfdf1920dbfa9c83d179b662d144647e2bf86f9",
  "url": "https://osv.dev/vulnerability/CVE-2018-18385",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2018-18385",
    "summary": "Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.",
    "evidence": "osv:CVE-2018-18385",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2018-18385",
      "aliases": [
        "CVE-2018-18385",
        "GHSA-qc9p-mjxm-j2wj"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/asciidoctor/asciidoctor",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "d7aeb752494c895fd7a116a7cf3a442deb9ac396"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:asciidoctor:asciidoctor:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.5.8"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.5.7",
            "v1.5.6.1",
            "v1.5.6",
            "v1.5.5",
            "v1.5.4",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.5.0.rc.6",
            "v1.5.0.rc.5",
            "v1.5.0.rc.4",
            "v1.5.0.rc.3",
            "v1.5.0.rc.2",
            "v1.5.0.rc.1",
            "v1.5.0.preview.8",
            "v1.5.0.preview.7",
            "v1.5.0.preview.6",
            "v1.5.0.preview.5",
            "v1.5.0.pre.preview.5",
            "v1.5.0.preview4",
            "v1.5.0.preview3",
            "v1.5.0.preview.2",
            "v1.5.0.preview.1",
            "v0.1.4",
            "v0.1.4.rc.2",
            "v0.1.4.rc.1",
            "v0.1.4.preview.3",
            "v0.1.4.preview.2",
            "v0.1.4.preview.1",
            "v0.1.3",
            "v0.1.2",
            "v0.1.2.cr",
            "v0.1.1",
            "v0.1.0",
            "v0.0.9",
            "v0.0.7",
            "v0.0.6",
            "v0.0.5",
            "v0.0.4",
            "v0.0.3",
            "v0.0.2",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18385.json"
          }
        }
      ],
      "modified": "2026-10-20T10:51:35.179113382Z",
      "provider": "osv",
      "references": [
        "https://github.com/asciidoctor/asciidoctor/issues/2888"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2018-18385",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 382608,
  "published_at": "2018-10-16T16:50:12.927+00:00"
}