{"id":"CVE-2018-21028","details":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","modified":"2026-08-22T09:15:31.125107Z","published":"2019-10-11T20:15:16.860Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:boa:boa:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"0.94.14.21"}],"source":"CPE_RANGE","vendor_product":"boa:boa"}]},"references":[{"type":"ADVISORY","url":"https://github.com/gpg/boa/pull/1"},{"type":"FIX","url":"https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpg/boa","events":[{"introduced":"0"},{"fixed":"7d0aa0391a30625856398a49e6a42342e2d14e4b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.94.14rc21"}],"source":"DESCRIPTION"}}],"versions":["upstream/0.94.14rc20","upstream/0.94.11","upstream/0.94.8.3","upstream/0.93.15","upstream/0.93.14.1","upstream/0.92"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21028.json","vanir_signatures_modified":"2026-08-22T09:15:31Z","vanir_signatures":[{"digest":{"function_hash":"220823450193352790724761540728821885038","length":3200},"id":"CVE-2018-21028-0118645c","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/index_dir.c","function":"index_directory"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/pipe.c"},"deprecated":false,"digest":{"line_hashes":["63294334405628449755993857779164787479","94825566254764396466132626758414897210","254549519308419991802351374028084607042","159357826781110764526351251346237153504","94714379446337151222953622276476898379","295765914123914240085405891609149900387","205978025721534729999402728045140100272","44262611751600843786294860943853469483","235877700460936932581392841685179540442","297325145783158178268087026438646119336","29552156337489209615026069301120955770","265571979369147997703247110319034314742","160615315031842019398178858862123703886","4344267942487811008734257676104218316","97536690181014371732153657852833915624","127512292933809808258435471450280890583","64792851290417272509341044435230451781","299958241328134890469188886815132247700","179771660679661120997837090816985929143"],"threshold":0.9},"id":"CVE-2018-21028-0a0808a1"},{"id":"CVE-2018-21028-20f3d8ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/range.c"},"deprecated":false,"digest":{"line_hashes":["309885841744986551993858678284861686744","53106768525200875161288343078150006742","306950623800313744729735625330820813366","150336388632771840084281197680498498562","91150829873695970955222033578640847695","325652023644520917764499648558566349302","225430467537952276621259709166074145553","225751867887304301517054735768375620406","300677330618268414948430583178361054972"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"57514279541819056004580925140866004253","length":356},"id":"CVE-2018-21028-26baa42b","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"function":"sighup_run","file":"src/signals.c"}},{"source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/mmap_cache.c","function":"release_mmap"},"deprecated":false,"digest":{"function_hash":"69886775732869681843709187800838380941","length":318},"id":"CVE-2018-21028-2b6fa662","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"260762484014441032722805197646831419437","length":288},"id":"CVE-2018-21028-334bbff6","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/sublog.c","function":"open_gen_fd"},"deprecated":false},{"source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/range.c","function":"ranges_fixup"},"deprecated":false,"digest":{"function_hash":"99337924851108423224193580507350194613","length":1231},"id":"CVE-2018-21028-4998b361","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/boa.c"},"deprecated":false,"digest":{"line_hashes":["191044754510389823871595153857608311213","251007451156215802987819617303491039146","170218499487155182421232840704962225718","294520195325905248947529815489493259726","16324564127723061873983111124250496937","312030142585711592260263598069344961099","159175998120829468722174431528435480018","86097653126184874518536064721407544351","100205047231404715202659932147039334739","274313376710733230906520673680043743544","267471697226547518199360757118112332962","112793034403739440255950804738973970286","321962512436979609917862945145478030240","281243367339508991182942531202934843209","165224509436041067962603035524855325118","132461721265789396304322946143784506051","86066565936745413437760374599226507353","222889396580972607200251280820257946485","197534113426348879335693212700507205090","61583803937952659494288469190925719379","104827655284670312818519699376184679765","15466401307158150043810880756350669937","339499117373794241587606202869220415003","140852171837642838914866257657503643080","309016158541236142320567982983504868536","220202105381038350125909069951943343735","292131424438932285537841277164730664283","324612900298354452452440463334660892035","201722608717659649125480939654099350133","18430708605267062889653387149644856934","284935478545849679046904612179059755038","52227222965393326464859516234512701336","206051557653452169539429320669669427831","200380383711336936394806944324723340369","81115426428947472311611576544322873872","83036811122132361540788595654738059627","59589658389896989571694047971344314158","211257592938291714369141065993598853856","277907599391620034514316244132722163490","133586889934318094777894504528451936220","189135750645725139649688826906430737707","38798964094558076533776888961621536551","6992789208830063052050429364632776595","102494192698470096532717146937815225926","67914805195595504670012849769925422043","108315931396396529029764521565812851784","131974848651814124745547424687453972948","136877921780053333218272647524509427873","15044991750241473440670789919721206545","95199155751516502331945039617252752345","210469514891529954222963193465483997476","80484821437998918860236228589026873238","212309236568868520391225556103097923776","332516965617671605996745122565700595843","109817625646331892696856369447701901202","293232361697028745037216243119319089884","129400911363356136524851968741275469208","147800748101869999635167658904914670508","201014330209870920183807436234613158560","60047520732527610481110202142711718460","102959353896279332764977704230906569633","23954193411558422146223385308260688918","72858027823718924160427887091918718231","226468578990915187572802400004456298124","188142956810625593885994386823141792945","189225615907355822501144031212785825762","334247310791093823211403953304930378636","332933640775675981990220602083609294337","78023284835213616185103901878430025035","7474707375940978020050461544446778515","328607621134601827114646574726573978691","170544129220067324244119225109722291158","105763686501570935230127901584020166890","107958616903134271309311089338457752777"],"threshold":0.9},"id":"CVE-2018-21028-4af46b78"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/sublog.c"},"deprecated":false,"digest":{"line_hashes":["158729894522543271203206778134314103178","228034807357028361423178602232621717472","224830679840791847217646443069108402211","59937836320046364318648575719924334066","92635375745305131488916742183724300597","251985122330190922097183100326031877703","141609974105254923510044078053690299967","64329899242050754524683153945749255982","291125172570132235275522650042237317098","48933605466758498276664221696162874081","309839541825917609747918842157099297514","282130218536764059776870322630341446733","49433988428355063692839009775424793880","32935165991835627634260262565600242700","209106178680531970798507550607663531759","157364587726694392653275088451115934329"],"threshold":0.9},"id":"CVE-2018-21028-5018ffcc"},{"id":"CVE-2018-21028-5451e639","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"function":"req_write","file":"src/buffer.c"},"deprecated":false,"digest":{"function_hash":"320839486294719775777298607872633990743","length":760}},{"target":{"file":"src/read.c"},"deprecated":false,"digest":{"line_hashes":["168342482092698679584726796684199284612","228498918280931789961563043099657763022","160268451546450575596014491703652119934","303173799533142637606958294897970820245","194140490642489669817555150231333600418","330828389521657132615580306554193270040","221442077980976988501997262275617085193","117955564547163503338901424995187618539","194748509024105564783673852434180696264","275928861566576737665195209902926647029","181109002378721135312090562065191853488","221488901029067841994585691522370194542","11920034710618647650197071984884244826","56853803621212859023730572570931235599","329846982022133628698848203497756834882","274222018127144154752336869165040435075","161526116896223547736576465576862647982","115821334131934287438672143654529751672","206123134087855743067837174858660681731","10316810131229509003868650923305266489","61182944053723095671076535167138322851","177979865522344647629550068499129533631","6252373942245610372887152257211722842","128562999733474913586859858238947632881","278857267315710961684277843576355065012","264773299329241148008650822664045757277","29394710368613445367164102658455295465","107652043447867534874475347268162110447","20902123928331943517725690464976654051","191160491490120893298281198830913111359","50935748099099239198188725939989326465","197109452123174724050522139911209140549","273970915825773747826454250176528545462","135437754797823377596549458820466760099","93659294753907442054042409853082602567","4695744231841561937813546391967418158","23163987738071770711662483281248402297","50405180234411593251108135188811712132","229108313439616674059546669372909305246","459629889280033892903589719178762330","188425762315965461961376712423588808313","206851439523078575122124533119911379820","316344271060954891375530392192301375301","97190465503637019560191663023375872161","42290781364820481181959801302409300875","205862329537767815557725180947697076566","59542976224244810103169411043452356952","88830742578205972849726067338648905731","119136457930881262414893346492479581320","265903612234349772391368719163032496771","101135111194559189312832192999352526126","305151003480957185480057195636297720048","246850117746803210780084981358001589517","298478943189000671924044060588281111516","44251901906792703676716348572817156358","312051900732645182102974041179040479980","259419260776583177008669083342314342508","41025888085062858845586667862593304924","37613456263404467413167792639104727492"],"threshold":0.9},"id":"CVE-2018-21028-61d84998","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b"},{"signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/request.c"},"deprecated":false,"digest":{"line_hashes":["112746267007681181733909601745987932120","230616302462043378676518266591868095180","146934030982588350304508974106075038766","274071363809798396808700253340842273807","88742460128570135626103986075864914134","270871587214525742282658111214251970732","161260763803986472836126764768058156662","32188066220881073643047324675110208019","157659467499986251763986166164874673922","83156152796814514112265682012155930206","126102452062953866726687052083373535119","305512272601535294754032335329631150040","94520971332246247249471004719695419504"],"threshold":0.9},"id":"CVE-2018-21028-6c004df4","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"85920654455626937844995460953659117526","length":503},"id":"CVE-2018-21028-72da8142","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/alias.c","function":"get_alias_hash_value"}},{"digest":{"function_hash":"266103530113105527454377046919292807072","length":1949},"id":"CVE-2018-21028-760906af","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/range.c","function":"range_parse"},"deprecated":false},{"deprecated":false,"digest":{"length":3609,"function_hash":"282876725592708722696313489809165707922"},"id":"CVE-2018-21028-8494f44f","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/request.c","function":"get_request"}},{"target":{"file":"src/sublog.c","function":"open_pipe_fd"},"deprecated":false,"digest":{"function_hash":"308687548679789815274005952759622001910","length":448},"id":"CVE-2018-21028-859d0b85","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b"},{"digest":{"function_hash":"252238033875466294024082993772792915118","length":1164},"id":"CVE-2018-21028-9092f769","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"function":"main","file":"src/boa.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/alias.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["308232103266422108825891107712459373769","47939841076745728914238009403740143497","294754406696651080282190458753176833354","186848873449112250623250980698347428436","135666044320536189018656993427854957462","246261591752627016388581347547206442831","149183839176890687490417252815923546403","262193134347759871379199725973043793764","207981918424567436335694994858934558899","58277205519910598872215949949751751640","188040744000041572701377444674146524239","103266292074662134118226770491979927194","190825334609571490413080208190048910444","188040744000041572701377444674146524239","103266292074662134118226770491979927194","190825334609571490413080208190048910444"]},"id":"CVE-2018-21028-aa167435","signature_type":"Line"},{"target":{"file":"src/mmap_cache.c"},"deprecated":false,"digest":{"line_hashes":["90633165510772272901082066432397497940","317694287111012345122889547768044236104","110687070051990022979792802942260733762","281121809564986436355056427003265591885","176923426849730728696550743150061701648","149840433563510279176206373803060874919","257750928831536605130994189131578812024","165785786842941413735251399929763818582","217029928180700478449742429193933912411"],"threshold":0.9},"id":"CVE-2018-21028-b64fddcd","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b"},{"deprecated":false,"digest":{"function_hash":"340163824190887113542576351965610880142","length":761},"id":"CVE-2018-21028-b69b921e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/pipe.c","function":"write_from_pipe"}},{"digest":{"function_hash":"339455900659938164395849729926779940149","length":4655},"id":"CVE-2018-21028-b75d29d2","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/read.c","function":"read_header"},"deprecated":false},{"source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/signals.c"},"deprecated":false,"digest":{"line_hashes":["62298524673907012560609452708193506860","4953011461453648411833966101243782959","16801057236119515358987209721188142379","175071811363975135174607672306634945724","250427732829577038888708683996496707599"],"threshold":0.9},"id":"CVE-2018-21028-ba57d4d1","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/sublog.c","function":"open_net_fd"},"deprecated":false,"digest":{"function_hash":"328266317285794083273437280620689149867","length":629},"id":"CVE-2018-21028-bd83174e"},{"target":{"file":"src/config.c"},"deprecated":false,"digest":{"line_hashes":["127138678361347787723529114776411599742","70116752152036280637390407027002873749","210566312119249204491899646859449487815","24402445115991109207981430609445815739","333432284930895693019439460487156189954","6325379477154338130434219963651157669","182193673239305948558578786474912296581","105498221660914536524797984194253136457","318672384800710484064827289050268783944","148447911673073673875853279445928343775"],"threshold":0.9},"id":"CVE-2018-21028-c2c488d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b"},{"signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/index_dir.c"},"deprecated":false,"digest":{"line_hashes":["333431822516599253409820358587994525057","142815111031042346734116079187263649788","175788308774981702483420453200079818231","38552940338332518968873559175270225517","5321775106783954256111391970070875022","243208533652987941828195875213285965295","177091778909474936140389064802457296590","198983023572269062785510775017516443699","87624299100992607312615603336041330532","241853877135161875702689452634333723827","266495762915826498564163465828715301027","4157087087201068864385307830572991893","300905757626039613969842718675776276895","76817873333124987621702217174665048104","307751414765800461345641793823509900058","257863625702094523736377401342458947864","214764810003580491779929974476295547296","21754069933020772267740227354757684914","316028626596887107796418772086158058950","114203055274522557928581146174805436851","160300710175378443103423532741332644699","23579110590783684759804195513860822543","110917193211843570577672888732138821683","178910204962482100847587791572455115011","80706097667322835513337773491262287617","152841230034429271071814584449721430422","125834901395992872263876511753162006844","245850286031037017990504970156132540078","34954792344692880190784247377732761976","307073830809166873721137428887895778254","238086986141511334864663527761830382925"],"threshold":0.9},"id":"CVE-2018-21028-d2529f2e","signature_type":"Line"},{"source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/globals.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["326782391088866303498527234350665926698","206544563054418567451902914031678711978","300140412441558584687942778965284744900","280413521338662130955804462924013017858","25315663787870576932773530527312309845"]},"id":"CVE-2018-21028-e2818ef9","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["195320847760242880543437940270345329103","289801243460939303190330859008917431280","195695343851913820942238590023425341450","185010443355613203047031292409075656081","150163089017976250444294826240463969130"],"threshold":0.9},"id":"CVE-2018-21028-e4ce321d","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/util.c"}},{"source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/pipe.c","function":"io_shuffle_sendfile"},"deprecated":false,"digest":{"function_hash":"201361996687462865407845143075954242524","length":895},"id":"CVE-2018-21028-ea3f1b16","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/buffer.c"},"deprecated":false,"digest":{"line_hashes":["221008766272850137858545975885998584342","96809849929446320530641793182308408451","44911850794202664653107308204912626149","62639656446822658727345576824164256404","171909518342492233381470129626936190709"],"threshold":0.9},"id":"CVE-2018-21028-ef8e6322"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b","target":{"file":"src/config.c","function":"read_config_files"},"deprecated":false,"digest":{"function_hash":"322880290038542073295904244075497764188","length":2018},"id":"CVE-2018-21028-f1f20560"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}