CVE-2018-18385

Vulnerability

Asciidoctor versions prior to 1.5.8 contain a denial-of-service vulnerability in the Parser#next_block method. The while loop in this method expects to exhaust all lines from the reader, but a mismatch between the regular expression that detects any list and the regular expression for a specific list type causes a line to be repeatedly pushed back onto the reader, resulting in an infinite loop [1][2][4].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted AsciiDoc file that triggers the regex mismatch. No authentication or special privileges are required; the attacker only needs to supply the malicious input to an application using Asciidoctor (e.g., via file upload or web form). The parser then enters an infinite loop, consuming CPU resources indefinitely [2][4].

Impact

Successful exploitation leads to a denial of service (infinite loop) causing high CPU usage and potentially making the application unresponsive. No data confidentiality or integrity is compromised; the impact is limited to availability [2].

Mitigation

The fix was released in Asciidoctor version 1.5.8. Users should upgrade to 1.5.8 or later. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog [1][2][3][4].