Platform
windows
Component
keepass-password-safe
Fixed in
2.44.1
CVE-2020-37178 describes a denial-of-service (DoS) vulnerability present in KeePass Password Safe versions prior to 2.44. An attacker can exploit this flaw by crafting and dragging malicious HTML files into the application's help system, potentially leading to instability or a complete crash. This vulnerability impacts users running KeePass Password Safe versions 2.44 and earlier.
The primary impact of CVE-2020-37178 is a denial-of-service condition. Successful exploitation allows an attacker to crash the KeePass Password Safe application, preventing legitimate users from accessing their stored passwords. While this vulnerability doesn't directly lead to data exfiltration or unauthorized access, it can disrupt operations and potentially be used as a distraction tactic in a larger attack. The ease of exploitation – simply dragging a file – makes it a relatively low-effort attack vector.
CVE-2020-37178 was publicly disclosed on 2026-02-11. There are currently no known public proof-of-concept exploits available. The EPSS score is likely low, given the lack of public exploitation and the relatively simple nature of the attack. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.03% (9% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2020-37178 is to upgrade KeePass Password Safe to version 2.44 or later. This version contains a fix that addresses the vulnerability in the help system's HTML handling. If immediate upgrading is not possible, consider restricting user access to the help system or implementing input validation to prevent the loading of potentially malicious HTML files. There are no specific WAF or proxy rules that can directly mitigate this vulnerability, as it occurs within the application itself.
Actualice KeePass Password Safe a la versión 2.44 o posterior. Esta versión corrige la vulnerabilidad de denegación de servicio al manejar archivos HTML en el sistema de ayuda. Descargue la última versión desde el sitio web oficial de KeePass.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2020-37178 is a denial-of-service vulnerability in KeePass Password Safe versions before 2.44. Attackers can crash the application by dragging malicious HTML files into the help system.
Yes, if you are using KeePass Password Safe version 2.44 or earlier, you are affected by this vulnerability.
Upgrade KeePass Password Safe to version 2.44 or later to resolve the vulnerability.
There are currently no reports of active exploitation of CVE-2020-37178.
Refer to the official KeePass Password Safe website for the advisory and release notes: https://keepass.info/.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.