CVE-2018-5735: Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-30 · updated 2026-06-17
Weakness: CWE-617

Description

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.

Affected products

Debian Linux: 8.0, 9.0, 10.0

References

https://security-tracker.debian.org/tracker/CVE-2018-5735
https://security-tracker.debian.org/tracker/CVE-2018-5735

Get alerted when CVE-2018-5735 or the next vulnerability affects your stack