CVE-2018-16789: Shellinabox Project Shellinabox

High severity, CVSS 7.5. EPSS: 6% chance of exploitation in the next 30 days.

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

Affected products

• Shellinabox Project Shellinabox: up to and including 2.20

Published 2019-03-21. Last modified 2026-06-17.