CVE-2018-16789: libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic.

Security readout for executives and security teams

CVE-2018-16789 is a denial-of-service flaw in Shell In A Box through 2.20. A malformed web request can make shellinaboxd loop continuously, consuming CPU and taking the web terminal service offline. The main business impact is availability, not confirmed data theft or remote code execution. Exposure is most likely where shellinaboxd through 2.20 is reachable over HTTP or HTTPS, especially internet-facing web terminal deployments. Internal-only services are still exposed to authenticated users or attackers with network access. Prioritize remediation for internet-facing or business-critical web terminal services. This is an availability issue with public details, but the source bundle does not support emergency treatment as actively exploited or critical. Mitigation focus: Inventory all shellinaboxd deployments and identify versions through 2.20.; Apply a vendor package update or build including upstream commit 4f0ecc31.; If no package fix exists, follow current maintainer or distribution guidance..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.