CVE-2018-1000300: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only; version 18.04 only
• Haxx Curl: from 7.54.1, up to and including 7.59.0

Published 2018-05-24. Last modified 2026-06-17.