Is CVE-2018-19115 being actively exploited?

CVE-2018-19115 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2018-19115?

CVE-2018-19115 has a CVSS 3.0 base score of 9.8 (CRITICAL).

CVE-2018-19115

CRITICAL · CVSS 9.8EPSS 3.7%EU EUVD

keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.

Key facts

CVSS score: 9.8 (v3.0)
Severity: CRITICAL
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
EPSS score: 3.7% (90th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2018-10828)
Published: November 8, 2018
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2018-10828 in the EU Vulnerability Database. Last updated in EUVD on August 5, 2024.

View on the EU Vulnerability Database

Affected products

debian / debian linux
keepalived / keepalived
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server eus
redhat / enterprise linux server tus
redhat / enterprise linux workstation

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 7.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11039-2020 - archived

References

https://access.redhat.com/errata/RHSA-2019:0022(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:1792
https://access.redhat.com/errata/RHSA-2019:1945
https://bugzilla.suse.com/show_bug.cgi?id=1015141(Issue Tracking, Third Party Advisory)
https://github.com/acassen/keepalived/pull/961(Patch, Third Party Advisory)
https://github.com/acassen/keepalived/pull/961/commits/f28015671a4b04785859d1b4b1327b367b6a10e9(Patch, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2018/11/msg00034.html(Mailing List, Third Party Advisory)
https://security.gentoo.org/glsa/201903-01(Third Party Advisory)
https://usn.ubuntu.com/3995-1/
https://usn.ubuntu.com/3995-2/

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain