What is CVE-2018-1000807?

CVE-2018-1000807 is a high-severity vulnerability in Pyopenssl, classified under Use After Free. CVSS score: 8.1/10. Published 2018-10-08.

How severe is CVE-2018-1000807?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2018-1000807 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Use After Free in Pyopenssl

CVE-2018-1000807

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

Vulnerability class: Use-After-Free

Published 2018-10-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.041 (90.4th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.041 · newest: 0.041 · change: 0.000

Affected products

Pyopenssl
Canonical Ubuntu Linux — versions 16.04
Red Hat Enterprise Linux Desktop — versions 7.0
Red Hat Enterprise Linux Server — versions 7.0
Red Hat Enterprise Linux Workstation — versions 7.0
Red Hat OpenStack — versions 13

Weakness classification (CWE)

CWE-416 — Use After Free

Public proof-of-concept exploits

References

github.com/pyca/pyopenssl/pull/723 (Patch, Third Party Advisory)
access.redhat.com/errata/RHSA-2019:0085 (vendor-advisory, Third Party Advisory)
usn.ubuntu.com/3813-1/ (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html (vendor-advisory, Mailing List, Third Party Advisory)
github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509

Frequently asked questions

What is CVE-2018-1000807?: CVE-2018-1000807 is a high-severity vulnerability in Pyopenssl, classified under Use After Free. CVSS score: 8.1/10. Published 2018-10-08.
How severe is CVE-2018-1000807?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2018-1000807 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.