CVE-2018-25368CWE-789

CVE-2018-25368

High · published May 25, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long string in the password field. Attackers can paste a buffer of repeated characters into the password input field to trigger an application crash when attempting to authenticate.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.4th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-05-25T19:16Z
References (3)
https://nordvpn.com/download/ · [email protected]https://www.exploit-db.com/exploits/45304 · [email protected]https://www.vulncheck.com/advisories/nord-vpn-denial-of-service-via-password-field · [email protected]
EPSS history
Timeline
  • 25 MAY 14:15Z
    Nord VPN 6.14.31 Denial of Service via Password Field
    cvelistv5