{"id":"CVE-2018-15503","details":"The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.","modified":"2026-08-07T14:58:19.055840Z","published":"2018-08-18T02:29:01.903Z","references":[{"type":"ADVISORY","url":"https://x-c3ll.github.io/posts/swoole-deserialization-cve-2018-15503/"},{"type":"REPORT","url":"https://github.com/swoole/swoole-src/issues/1882"},{"type":"FIX","url":"https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/swoole/swoole-src","events":[{"introduced":"45d5548b4694c5a12cbf2791f783345dc649248f"},{"last_affected":"45d5548b4694c5a12cbf2791f783345dc649248f"},{"fixed":"4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76"}],"database_specific":{"cpe":"cpe:2.3:a:swoole:swoole:4.0.4:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0.4"},{"last_affected":"4.0.4"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.0.4","v4.0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15503.json","vanir_signatures_modified":"2026-08-07T14:58:19Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["27327491658145454191183675913643776429","148048807536482572215586536771339738588","283056574427884682559347186794914941418","213249443360257041689340304519941112868","318211189092762964607899582701197996941","325586135594676032070933732792265352364","60250848877633725423467952236233047961","193928308526599799562657054746859178398","290215068655936449849315935681529697390","138322607239213698195144770483271216372","107502444112180363988132374369772254753","100729956685838176420296933823721269024","238727235480119949518621090597555073344","241349047050587373507823947572682297638","78658625519362234703748523435312838803","272802496951304390691776853666002928819","320511055104847322128622315090697391152","201473792045770936698260223075276746956","23573621074776207803669741844438332217","14051873899177502666652206406504449282","129917739313696490973588035350260901877","48388560018899975588189046785252654529","261901743359053347146790267173023104987","307644484239422863601471837353275368912","176332053495123133507309196490829896605","323589299298277861054358827003843347974","28547117671666146593711377468577478431","171333452854614614648488981435552391449","334395012224011817425370836445045078535","26111335624330013360521534319313497519","266821887424731514123034154167411288515","25447854650120164534391751663801069979","327234130101062182132427137447014610783","159079352578140155719879666040575442732","56641894742932420552591561377705977110","152912504076660897336789472398717619022","33906086985070029895642435956578985079","230097608567604611718010811238591773295","283232720140953370980512360494506939622","188068747475457696627226028899988535556","321509063608130991665151037753226722147","302949476307151174658676864277013884656","317991733007872837764271201616247537332","141768626499739944874964223599756327275","103513362096957724745752878078729772662","165720724189363332595105183712098095657","213669649980921230164748039476807524078","278848706141794982063792174636189529544","83464867095809643361568066103600843157","99155559758259427326448968642695258977","133536398020341505954534705639892918817","295254574363935325581513836999733578835","203136309299955687542531606834298261261","28351150684673421230011221202913902551","105213459459570488306833114628324582823","150393883604825164261125322830224564432","7322178836093550152217245921517121601","208555204237619035409437617326673453382","69980791114788433178778901064012690845","111582348291770140753196794814080666974","182842265259205944363665646648920181649","142031272278059470626236525227376139855","146365932269968186626338745068982218388","297840103747106103489247109123754561034","15563753485887060882806852773665310102","204958722603496130489783024501384446657","52952650195088612365759691771035869222","289737150032685633002567751935030688566","294603045187479088122863961876354866468","255403995450770575122846272910852398748","20559693802094135355274655986531866153","40494958459989259073120009719054271166","21695092667311571725913497271549289127","200202199171036848171812577072777966837","243057938335440837846554953894876672073","239421360128750571614283472190588109249","145860006630588336152315330130957040034","204005586689554083245857935146798685820","167015424144793724895002381029642619492","218435309553503918082886926695327921477","87949967545735998827221793577691630035","172936496441426647203921872944039142492","164267180215824700930871996614690917122","131556727908386932494181408771695405806","271627373123688872534993878325267034228","18364144360704496106071289164749629822","26676772014427311647508812586048365181","339014513781378484133674874511558397878","76011477818279422107665507817830027754","33969356981804966307708670647616806805","308648868682388008881526641693864311327","240336815238153821223253112225200513380","183426384361946385474998866494890955479","253020265647369308575475026557585160446","217507894517799465948790320424585067027","154650079309687025265711702369329916300","224966538183654662635547846678170495540","153266905823553643692493609271176621560","146725461065721510000280617900680856366","4229462487597641839469268384344992101","53717912032287449548674700205159532859","48021297176697479224559806049979980360","303947384015353139543437970395630434309","280356914673185159874168905764325576218","192254923037187130481602185671254937903","99999582607575932425425703254378837543","309706439792041737141289277193048449921","324748200011652523415297010377685851577","211811574193521626578506715468106834156","260149460405364405285219849237153422697","226884959753414229757505685733062883085","186948627384224449206655777720868819784","38810970074185088631695875232190053790","27478797108306352467018482344266443329","304022615912595311752183980058035205701","149733089642629124580782758979305825381","65613085247483612926573864999451422540","287367316625471749782398696303580357976","46222446102890343579882219450402325543","217751011054620762328976154385889607211","223674990117998315544811432133763514393","301632747045236765709829602257048062176","317971202453778553466141153584909822225","187251091696734224064650643454611184125","76029178714483655219853895106846785373","38744611620166088143246250994298655398","52897369843780487064679246906830909193","251047019546816087681699781443042620198","178750544375494593575796502520157044375","317822795472935949728264787005721104550","235670051893760636286794743993557747677","144511123968619370157539121928235807758","333074141710635353878506192750459148821","17796315904687122028133488608343116889","259392448332287048425503879140271109699","226503316293263377468231564785337444419","263096118317057747137590189610829072104","101183740133082148148942903016268110466","37194199808753995600750662872922213834","243871890968892327296449964767250524638","152805933660972115938685077011252904300","259336958830447301668384249554204296132","239932998423781011822415815175999028881","159524618340104038336147638933635191576","223146673687394241126074151815243409886","165364225576327166500434532982342313204","259336958830447301668384249554204296132","239932998423781011822415815175999028881","159524618340104038336147638933635191576","97235824124646500755070299067597799344"],"threshold":0.9},"id":"CVE-2018-15503-6eed4cf2","signature_type":"Line","signature_version":"v1","source":"https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76","target":{"file":"swoole_serialize.c"}},{"digest":{"function_hash":"269618928546804415795011286133509488357","length":1361},"id":"CVE-2018-15503-8c035274","signature_type":"Function","signature_version":"v1","source":"https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76","target":{"file":"swoole_serialize.c","function":"php_swoole_unserialize"},"deprecated":false},{"id":"CVE-2018-15503-dcc8d327","signature_type":"Function","signature_version":"v1","source":"https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76","target":{"function":"swoole_unserialize_object","file":"swoole_serialize.c"},"deprecated":false,"digest":{"function_hash":"297101157815826533612672663763451683258","length":1598}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76","target":{"file":"swoole_serialize.c","function":"swoole_unserialize_arr"},"deprecated":false,"digest":{"function_hash":"308964144600458560027825076945430563540","length":3756},"id":"CVE-2018-15503-f8bc6d1f"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}