Critical
Security advisory
The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-6758
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:29 UTC · Revision 1
Source evidence
The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
osv:CVE-2018-6758
Complete source record
{
"id": "1af8fa6f3e8d5b045de3367d00f9be2e05b18f09197a8f7631dde1496f98308e",
"url": "https://osv.dev/vulnerability/CVE-2018-6758",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-6758",
"summary": "The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.",
"evidence": "osv:CVE-2018-6758",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2018-6758",
"aliases": [
"CVE-2018-6758"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/unbit/uwsgi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "d461b0c7087f181a28d25e8b06320ab5ec637f78"
},
{
"fixed": "cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:unbit:uwsgi:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.0.15"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.0.15",
"2.0.14",
"2.0.13.1",
"2.0.13",
"2.0.12",
"2.0.11.2",
"2.0.10",
"2.0.11.1",
"2.0.9",
"2.0.8",
"2.0.7",
"2.0.6",
"2.0.5.1",
"2.0.5",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0",
"2.0-rc1",
"1.9.21.1",
"1.9.21",
"1.9.19",
"1.9.18.1",
"1.9.17.1",
"1.9.17",
"1.9.16",
"1.9.15",
"1.9.14",
"1.9.13",
"1.9.12",
"1.9.11",
"1.9.10",
"1.9.9",
"1.9.8",
"1.9.7",
"1.9.6",
"1.9.5",
"1.9.4",
"1.9.3",
"1.9.2",
"1.9.1",
"1.9",
"1.9-rc2",
"1.9-rc1",
"1.4-rc2",
"1.4-rc1",
"1.3",
"1.3-rc4",
"1.3-rc3",
"1.3-rc2",
"1.2",
"1.2-rc2",
"1.2-rc1",
"1.1",
"1.1-rc4",
"1.1-rc3",
"1.1-rc2",
"1.1-rc1",
"1.0.1",
"1.0",
"1.0-rc10",
"1.0-rc9",
"1.0-rc8",
"1.0-rc7",
"1.0-rc6",
"1.0-rc5",
"1.0-rc4",
"1.0-rc3",
"1.0-rc2",
"1.0-rc1",
"0.9.9",
"0.9.9-rc2",
"0.9.9-rc1",
"0.9.9-beta1",
"0.9.8.3",
"0.9.8.2",
"0.9.8.1",
"0.9.8",
"0.9.8-rc4",
"0.9.8-rc3",
"0.9.8-rc2",
"0.9.8-rc1",
"0.9.7.2",
"0.9.7.1",
"0.9.7",
"0.9.7-rc3",
"0.9.7-rc2",
"0.9.7-rc1",
"0.9.7-beta1",
"0.9.6.2",
"0.9.6.1",
"0.9.6",
"0.9.6-rc2",
"0.9.6-rc1",
"0.9.5.1",
"0.9.5",
"0.9.5rc2",
"0.9.5rc1",
"0.9.5beta1",
"no_server_mode"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6758.json",
"vanir_signatures": [
{
"id": "CVE-2018-6758-e1f148c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243490772673003282157936558199904593426",
"181592824591725200369686474910206047044",
"158615905151477501614971574296757523196",
"315841527456661264510776714703848883239",
"26709189314742607060451259810244503048",
"289459625645574912563299582688155520997",
"219008088992257488316115284816062178646",
"28645312378549450316791241360275036809",
"212277688537049713480888295541017770230",
"164660208065612182782306403571297121072",
"304630623969915843393271732044436154810",
"95920019456127796046077306239782103910"
]
},
"source": "https://github.com/unbit/uwsgi/commit/cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe",
"target": {
"file": "core/utils.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-6758-ff0cd9e1",
"digest": {
"length": 337,
"function_hash": "117135496517650499400134591371153409223"
},
"source": "https://github.com/unbit/uwsgi/commit/cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe",
"target": {
"file": "core/utils.c",
"function": "uwsgi_expand_path"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:44:54Z"
}
}
],
"modified": "2026-10-20T13:44:54.956057677Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html",
"https://github.com/unbit/uwsgi/commit/cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-6758",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388015,
"published_at": "2018-02-06T18:29:00.447+00:00"
}