CVE catalog

CVE-2018-6758

uwsgi: CVE-2018-6758

Severity: Medium
Published: Feb 6, 2018, 6:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.05% · Oct 22, 2026

The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	uwsgi	sid	`2.0.31-6`	fixed
Debian	uwsgi	forky	`2.0.31-6`	fixed
Debian	uwsgi	trixie	`2.0.28-9`	fixed
Debian	uwsgi	bookworm	`2.0.21-5.1`	fixed
Alpine	uwsgi	3.10	`2.0.16-r0`	fixed
Alpine	uwsgi	3.11	`2.0.16-r0`	fixed
Alpine	uwsgi	3.12	`2.0.16-r0`	fixed
Alpine	uwsgi	3.13	`2.0.16-r0`	fixed
Alpine	uwsgi	3.14	`2.0.16-r0`	fixed
Alpine	uwsgi	3.15	`2.0.16-r0`	fixed
Alpine	uwsgi	3.16	`2.0.16-r0`	fixed
Alpine	uwsgi	3.17	`2.0.16-r0`	fixed
Alpine	uwsgi	3.18	`2.0.16-r0`	fixed
Alpine	uwsgi	3.19	`2.0.16-r0`	fixed
Alpine	uwsgi	3.20	`2.0.16-r0`	fixed
Alpine	uwsgi	3.21	`2.0.16-r0`	fixed
Alpine	uwsgi	3.22	`2.0.16-r0`	fixed
Alpine	uwsgi	3.23	`2.0.16-r0`	fixed
Alpine	uwsgi	3.24	`2.0.16-r0`	fixed
Alpine	uwsgi	3.4	`2.0.16-r0`	fixed
Alpine	uwsgi	3.5	`2.0.16-r0`	fixed
Alpine	uwsgi	3.6	`2.0.16-r0`	fixed
Alpine	uwsgi	3.7	`2.0.16-r0`	fixed
Alpine	uwsgi	3.8	`2.0.16-r0`	fixed
Alpine	uwsgi	3.9	`2.0.16-r0`	fixed
Opensuse	uwsgi	tumbleweed	`2.0.19.1-3.10`	fixed
Ubuntu	uwsgi	14.04	`1.9.13-4build1`	vulnerable
Ubuntu	uwsgi	14.04	`1.9.17.1-5`	vulnerable
Ubuntu	uwsgi	14.04	`1.9.17.1-5build2`	vulnerable
Ubuntu	uwsgi	14.04	`1.9.17.1-5build4`	vulnerable
Ubuntu	uwsgi	14.04	`1.9.17.1-5build5`	vulnerable
Ubuntu	uwsgi	14.04	`1.9.17.1-5ubuntu0.1`	fixed
Ubuntu	uwsgi	16.04	`2.0.7-1ubuntu5`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.7-1ubuntu6`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.11.2-6ubuntu1`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.11.2-6ubuntu2`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.12-4ubuntu2`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.12-5ubuntu1`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.12-5ubuntu2`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.12-5ubuntu3`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.12-5ubuntu3.1`	vulnerable
Ubuntu	uwsgi	16.04	`2.0.12-5ubuntu3.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	uwsgi	source	sid	`2.0.15-10.2`	not yet assigned	Not reported	[889753]
Debian	uwsgi	source	forky	`2.0.15-10.2`	not yet assigned	Not reported	[889753]
Debian	uwsgi	source	trixie	`2.0.15-10.2`	not yet assigned	Not reported	[889753]
Debian	uwsgi	source	bookworm	`2.0.15-10.2`	not yet assigned	Not reported	[889753]
Alpine	uwsgi	apk	3.10	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.11	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.12	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.13	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.14	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.15	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.16	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.17	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.18	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.19	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.20	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.21	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.22	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.23	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.24	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.4	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.5	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.6	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.7	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.8	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Alpine	uwsgi	apk	3.9	`2.0.16-r0`	Not reported	ALPINE-CVE-2018-6758	Not reported
Opensuse	uwsgi	rpm	tumbleweed	`2.0.19.1-3.10`	Not reported	OPENSUSE-SU-2024:11490-1	Not reported
Ubuntu	uwsgi	deb	14.04	`1.9.17.1-5ubuntu0.1`	Not reported	UBUNTU-CVE-2018-6758	Not reported
Ubuntu	uwsgi	deb	16.04	`2.0.12-5ubuntu3.2`	Not reported	UBUNTU-CVE-2018-6758	Not reported

[Debian bug #889753]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[apache2-mod_uwsgi]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[python313-uwsgi-python3]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[python314-uwsgi-python3]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-emperor_pg]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-emperor_zeromq]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-gevent]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-greenlet]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-jvm]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-ldap]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-libffi]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-logzmq]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-lua]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-pam]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-php8]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-psgi]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-pypy]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-sqlite3]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed
[uwsgi-xslt]Unknown
Source package: [uwsgi]
Details (1)
- 2.0.31-4.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.19.1-3.10
  Version impact unknown
  dsa · uwsgi · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libapache2-mod-ruwsgi]Fixed
Source package: [uwsgi]
Details (2)
- 2.0.21-5.1 · amd64 · bookworm
  Fixed · Fixed: 2.0.15-10.2
  dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12
- 2.0.21-5.1 · arm64 · bookworm
  Fixed · Fixed: 2.0.15-10.2
  dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12
[libapache2-mod-ruwsgi-dbg]Fixed
Source package: [uwsgi]
Details (2)
- 2.0.21-5.1 · amd64 · bookworm
  Fixed · Fixed: 2.0.15-10.2
  dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12
- 2.0.21-5.1 · arm64 · bookworm
  Fixed · Fixed: 2.0.15-10.2
  dsa · uwsgi · debian · bookworm; dsa · uwsgi · debian · 12

Next results

Observed: Oct 23, 2026, 5:37:35 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]