CVE-2018-13844
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue has been found in HTSlib 1.8. It is a memory leak in fai_read in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by fai_load() in their own code
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA memory leak exists in the fai_read function in faidx.c of HTSlib 1.8. The function fails to properly release memory allocated for FASTA index handling. The vulnerability is disputed by maintainers who argue it exists only in the test harness and that application developers must manually call the destructor for objects returned by fai_load().
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 1.8CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed HTSlib versionRun 'hts_version' command or check library file version (e.g., libhts.so.1.8) or grep for version in header filesAffected if Version is exactly 1.8
-
Identify if fai_load() is called in application codeSearch source code for 'fai_load' function calls (e.g., grep -r 'fai_load' --include='*.c' --include='*.cpp')Affected if Application code calls fai_load() to load FASTA indices
-
Verify fai_destroy() is called after fai_load()Search source code for fai_destroy() calls on the same FASTA index object returned by fai_load(). Ensure every fai_load() has a corresponding fai_destroy() in error paths and normal exitsAffected if fai_destroy() is NOT called, or not called in all code paths, after fai_load() returns a valid index handle
-
Check for FASTA/FAI file operations in running processesMonitor process memory usage over time while performing FASTA index operations (e.g., using fai_read or hts_idx_load). Observe if memory grows continuously without releaseAffected if Memory usage grows unbounded during FASTA index operations
You are affected if you use HTSlib version 1.8 AND your application calls fai_load() without calling fai_destroy() on the returned index handle in all code paths.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApplications using HTSlib must ensure they properly call the destructor (fai_destroy) on FASTA index objects returned by fai_load() to prevent memory leaks. Consider patching the library to automatically handle cleanup or verify the test harness properly releases resources.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2018-13844 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2018-13844 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data