medium 5.5

CVE-2020-18770 json

An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.

published 2023-08-22 3 y ago modified 2026-06-17 4 mo ago also EUVD-2020-10687

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

Patch / fix

distros 7

debian red hat suse opensuse almalinux rocky linux azure linux

zziplib Debian 14, Debian 13 0.13.78+dfsg.1-0.1

debian advisories DEBIAN-CVE-2020-18770

zziplib RHEL 8 0.13.68-13.el8_10
zziplib-utils RHEL 8 0.13.68-13.el8_10
zziplib RHEL 9 0.13.71-11.el9_4
zziplib-utils RHEL 9 0.13.71-11.el9_4

red hat advisories RHSA-2024:3127 RHSA-2024:2377

zziplib SLES 15 SP4-TERADATA, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 0.13.69-150000.3.17.1
zziplib SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 0.13.67-10.36.1

suse advisories SUSE-SU-2024:0970-1 SUSE-SU-2024:0961-1

zziplib openSUSE Tumbleweed 0.13.72-3.1

opensuse advisories openSUSE-SU-2024:13746-1

zziplib AlmaLinux 8 0.13.68-13.el8_10
zziplib-utils AlmaLinux 8 0.13.68-13.el8_10
zziplib AlmaLinux 9 0.13.71-11.el9_4
zziplib-utils AlmaLinux 9 0.13.71-11.el9_4

almalinux advisories ALSA-2024:3127 ALSA-2024:2377

zziplib Rocky Linux 9 0.13.71-11.el9_4
zziplib Rocky Linux 8 0.13.68-13.el8_10

rocky linux advisories RLSA-2024:2377 RLSA-2024:3127

zziplib Azure Linux 3.0 0.13.74-1

azure linux advisories AZL-44868

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-18770 updated 2026-11-05 cvss 5.5

zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c

Red Hat Enterprise Linux 7 zziplib, zziplib-utils
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) zziplib 0.13.68-13.el8_10, zziplib-utils 0.13.68-13.el8_10
fixed: vendor fix RHSA-2024:3127
Red Hat Enterprise Linux AppStream (v. 9) zziplib 0.13.71-11.el9_4, zziplib-utils 0.13.71-11.el9_4
fixed: vendor fix RHSA-2024:2377
Red Hat Enterprise Linux CRB (v. 8) zziplib-devel 0.13.68-13.el8_10, zziplib-debuginfo 0.13.68-13.el8_10, zziplib-debugsource 0.13.68-13.el8_10, zziplib-utils-debuginfo 0.13.68-13.el8_10
fixed: vendor fix RHSA-2024:3127
Red Hat Enterprise Linux CRB (v. 9) zziplib-devel 0.13.71-11.el9_4, zziplib-debuginfo 0.13.71-11.el9_4, zziplib-debugsource 0.13.71-11.el9_4, zziplib-utils-debuginfo 0.13.71-11.el9_4
fixed: vendor fix RHSA-2024:2377

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-04)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/gdraheim/zziplib/issues/69 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

github.com /gdraheim/zziplib/issues/69
exploit, issue-tracking, third-party-advisory

Sources

CVE List CVE-2020-18770
NVD CVE-2020-18770

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary