High
Security advisory
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-16865
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:13 UTC · Revision 1
Source evidence
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
osv:CVE-2018-16865
Complete source record
{
"id": "4f95538919143e496f9faf99cbc1d7c3da565f3e69cd843a6485cc2de24d105a",
"url": "https://osv.dev/vulnerability/CVE-2018-16865",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-16865",
"summary": "An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.",
"evidence": "osv:CVE-2018-16865",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-16865",
"aliases": [
"CVE-2018-16865"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/systemd/systemd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1742aae2aa8cd33897250d6fcfbe10928e43eb2f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "240"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v240",
"v239",
"v238",
"v237",
"v236",
"v235",
"v234",
"v233",
"v232",
"v231",
"v230",
"v229",
"v228",
"v227",
"v226",
"v225",
"v224",
"v223",
"v222",
"v221",
"v219",
"v220",
"v218",
"v217",
"v216",
"v215",
"v214",
"v213",
"v212",
"v211",
"v210",
"v209",
"v208",
"v207",
"v206",
"v205",
"v204",
"v203",
"v202",
"v201",
"v200",
"v199",
"v198",
"v197",
"v196",
"v195",
"v194",
"v193",
"v192",
"v191",
"v190",
"v189",
"v188",
"v187",
"v186",
"v185",
"v184",
"v183",
"v44",
"v43",
"v42",
"v41",
"v40",
"v39",
"v38",
"v37",
"v36",
"v35",
"v34",
"v33",
"v32",
"v31",
"v30",
"v29",
"v28",
"v27",
"v26",
"v25",
"v24",
"v23",
"v22",
"v21",
"v20",
"v19",
"v18",
"v17",
"v16",
"v15",
"v14",
"v13",
"v12",
"v11",
"v10",
"v9",
"v8",
"v7",
"v6",
"v5",
"v4",
"v3",
"v2",
"v1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16865.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/systemd/systemd-stable",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1742aae2aa8cd33897250d6fcfbe10928e43eb2f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "240"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v240",
"v239",
"v238",
"v237",
"v236",
"v235",
"v234",
"v233",
"v232",
"v231",
"v230",
"v229",
"v228",
"v227",
"v226",
"v225",
"v224",
"v223",
"v222",
"v221",
"v219",
"v220",
"v218",
"v217",
"v216",
"v215",
"v214",
"v213",
"v212",
"v211",
"v210",
"v208",
"v209",
"v201",
"v204",
"v207",
"v206",
"v205",
"v203",
"v202",
"v200",
"v199",
"v198",
"v197",
"v196",
"systemd-v196",
"v195",
"systemd-v195",
"v194",
"systemd-v194",
"v193",
"systemd-v193",
"v192",
"systemd-v192",
"v191",
"systemd-v191",
"v190",
"systemd-v190",
"v189",
"systemd-v189",
"v188",
"systemd-v188",
"v187",
"systemd-v187",
"v186",
"systemd-v186",
"v185",
"systemd-v185",
"v184",
"systemd-v184",
"v183",
"systemd-v183",
"v44",
"systemd-v44",
"v43",
"systemd-v43",
"v42",
"systemd-v42",
"v41",
"systemd-v41",
"v40",
"systemd-v40",
"v39",
"systemd-v39",
"v38",
"systemd-v38",
"v37",
"systemd-v37",
"v36",
"systemd-v36",
"v35",
"systemd-v35",
"v34",
"systemd-v34",
"v33",
"systemd-v33",
"v32",
"systemd-v32",
"v31",
"systemd-v31",
"v30",
"systemd-v30",
"v29",
"systemd-v29",
"v28",
"systemd-v28",
"v27",
"systemd-v27",
"v26",
"systemd-v26",
"v25",
"systemd-v25",
"v24",
"systemd-v24",
"v23",
"systemd-v23",
"v22",
"systemd-v22",
"v21",
"systemd-v21",
"v20",
"systemd-v20",
"v19",
"systemd-v19",
"v18",
"systemd-v18",
"v17",
"systemd-v17",
"v16",
"systemd-v16",
"v15",
"systemd-v15",
"v14",
"systemd-v14",
"v13",
"systemd-v13",
"v12",
"systemd-v12",
"v11",
"systemd-v11",
"v10",
"systemd-v10",
"v9",
"systemd-v9",
"v8",
"systemd-v8",
"v7",
"systemd-v7",
"v6",
"systemd-v6",
"v5",
"systemd-v5",
"v4",
"systemd-v4",
"v3",
"systemd-v3",
"v2",
"systemd-v2",
"v1",
"systemd-v1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16865.json"
}
}
],
"modified": "2026-10-24T10:30:37.072998907Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHBA-2019:0327",
"https://access.redhat.com/errata/RHSA-2019:0049",
"https://access.redhat.com/errata/RHSA-2019:0204",
"https://access.redhat.com/errata/RHSA-2019:0271",
"https://access.redhat.com/errata/RHSA-2019:0342",
"https://access.redhat.com/errata/RHSA-2019:0361",
"https://access.redhat.com/errata/RHSA-2019:2402",
"https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html",
"https://seclists.org/bugtraq/2019/May/25",
"https://security.gentoo.org/glsa/201903-07",
"https://security.netapp.com/advisory/ntap-20190117-0001/",
"https://usn.ubuntu.com/3855-1/",
"https://www.debian.org/security/2019/dsa-4367",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.qualys.com/2019/01/09/system-down/system-down.txt"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "18.10"
},
{
"last_affected": "18.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_border_controller:8.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_border_controller",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.0"
},
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_communications_broker:3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_communications_broker",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "3.1.0"
},
{
"last_affected": "3.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_aus",
"extracted_events": [
{
"range": [
{
"introduced": "7.3"
},
{
"last_affected": "7.3"
},
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_eus",
"extracted_events": [
{
"range": [
{
"introduced": "7.5"
},
{
"last_affected": "7.5"
},
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_tus",
"extracted_events": [
{
"range": [
{
"introduced": "7.3"
},
{
"last_affected": "7.3"
},
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_workstation",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-16865",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 434118,
"published_at": "2019-01-11T21:29:00.257+00:00"
}