Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
Conclusion & alert: CVE-2018-0739 is rated Moderate Risk (64.8/100): CVSS Medium severity, with high exploitation likelihood (EPSS 19.30%, 97th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +4.85% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 14.45% | 19.30% | +4.85% |
| 2 | 2026-03-23 | 11.27% | 14.45% | +3.17% |
| 3 | 2026-03-04 | — | 11.27% | — |
Full EPSS history (66 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.5 | 3.0 | MEDIUM |
|
2.8 | 3.6 | [email protected] |
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
low | CVE-2018-0739 low priority: Debian including 2 source packages (libtomcrypt, openssl), 10 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 10. | https://security-tracker.debian.org/tracker/CVE-2018-0739 |
gentoo
|
normal | CVE-2018-0739: 2 GLSA(s) (201811-21, 202007-53), 2 atom(s) (dev-libs/openssl, net-misc/dropbear); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2018-0739 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2018-0739 |
suse
|
medium | CVE-2018-0739 severity moderate: SUSE including 529 source package names (0.9.1:libopenssl1_0_0-1.0.2j-60.24.1, 0.9.1:openssl-1.0.2j-60.24.1, …), 911 product×package rows across 113 product lines (Container caasp/v4/default-http-backend, Container caasp/v4/dnsmasq-nanny, … (113 product lines)): Fixed 519, Known Not Affected 235, Known Affected 157. | https://www.suse.com/security/cve/CVE-2018-0739/ |
ubuntu
|
medium | CVE-2018-0739 medium priority: Ubuntu including 3 source packages (openssl, openssl098, openssl1.0), 21 status rows across 7 suites (artful, bionic, cosmic, disco, trusty, upstream, xenial): DNE 10, released 9, needs-triage 2. | https://ubuntu.com/security/CVE-2018-0739 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| openssl | openssl | >= 1.0.2b, <= 1.0.2n | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| openssl | openssl | >= 1.1.0, <= 1.1.0g | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 14.04 | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
| canonical | ubuntu_linux | 16.04 | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
| canonical | ubuntu_linux | 17.10 | cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| debian | debian_linux | 8.0 | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |