Skip to content
Fencer Vulns
critical 9.8

CVE-2019-19012 in the critical feed json

An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which…

published 2019-11-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8663

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
10.6%
EPSS 10.6% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

Patch / fix

  • libonig Debian 14, Debian 13, Debian 12 6.9.4-1

debian advisories DEBIAN-CVE-2019-19012

  • libonig Ubuntu Pro 14.04 LTS 5.9.1-1ubuntu1.1+esm2
  • libonig Ubuntu Pro 16.04 LTS 5.9.6-1ubuntu0.1+esm2
  • libonig Ubuntu Pro 18.04 LTS 6.7.0-1ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2019-19012

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ruby RHEL 8 2.5.9-114.module+el8.10.0+23088+750dc6ca
  • ruby-irb RHEL 8 2.5.9-114.module+el8.10.0+23088+750dc6ca
  • rubygems RHEL 8 2.7.6.3-114.module+el8.10.0+23088+750dc6ca
  • ruby-libs RHEL 8 2.5.9-114.module+el8.10.0+23088+750dc6ca
  • rubygem-pg RHEL 8 1.0.0-3.module+el8.9.0+19193+435404ae
  • rubygem-abrt RHEL 8 0.3.0-4.module+el8.10.0+22021+135c76a8
  • rubygem-bson RHEL 8 4.3.0-2.module+el8.9.0+19193+435404ae
  • rubygem-json RHEL 8 2.1.0-114.module+el8.10.0+23088+750dc6ca

red hat advisories RHSA-2025:7539RHSA-2024:0889RHSA-2024:0572RHSA-2024:0409

  • oniguruma openSUSE Tumbleweed 6.9.7.1-1.2

opensuse advisories openSUSE-SU-2024:11111-1

  • ruby AlmaLinux 8 2.5.9-114.module_el8.10.0+3991+5e651d4e
  • ruby-irb AlmaLinux 8 2.5.9-114.module_el8.10.0+3991+5e651d4e
  • rubygems AlmaLinux 8 2.7.6.3-114.module_el8.10.0+3991+5e651d4e
  • ruby-libs AlmaLinux 8 2.5.9-114.module_el8.10.0+3991+5e651d4e
  • rubygem-pg AlmaLinux 8 1.0.0-3.module_el8.9.0+3635+c6f99506
  • rubygem-abrt AlmaLinux 8 0.3.0-4.module_el8.5.0+2625+ec418553
  • rubygem-bson AlmaLinux 8 4.3.0-2.module_el8.5.0+2625+ec418553
  • rubygem-bson AlmaLinux 8 4.3.0-2.module_el8.6.0+3170+4b08f9d4

almalinux advisories ALSA-2025:7539ALSA-2024:0889

  • ruby Rocky Linux 8 2.5.9-114.module+el8.10.0+1979+815637df
  • rubygem-pg Rocky Linux 8 1.0.0-3.module+el8.9.0+1536+5f79634e
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.5.0+738+032c9c02
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.9.0+1536+5f79634e
  • rubygem-bson Rocky Linux 8 4.3.0-2.module+el8.9.0+1536+5f79634e
  • rubygem-mongo Rocky Linux 8 2.5.1-2.module+el8.9.0+1536+5f79634e
  • rubygem-mysql2 Rocky Linux 8 0.4.10-4.module+el8.9.0+1536+5f79634e
  • rubygem-bundler Rocky Linux 8 1.16.1-5.module+el8.10.0+1979+815637df

rocky linux advisories RLSA-2025:7539

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19012 updated cvss 7.5

oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read

  • Red Hat Enterprise Linux 5 php, php53 Red Hat Enterprise Linux 6 php, php-gd, php-cli, php-dba, php-fpm, php-pdo, +21 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 ruby, ruby-irb, rubygems, ruby-libs, rubygem-pg, rubygem-irb, +25 more
    affected: no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder (v. 8) oniguruma-devel 6.8.2-2.1.el8_9, oniguruma-debuginfo 6.8.2-2.1.el8_9, oniguruma-debugsource 6.8.2-2.1.el8_9
    fixed: vendor fix RHSA-2024:0889
  • Red Hat CodeReady Linux Builder EUS (v.8.6) oniguruma-devel 6.8.2-2.1.el8_6, oniguruma-debuginfo 6.8.2-2.1.el8_6, oniguruma-debugsource 6.8.2-2.1.el8_6
    fixed: vendor fix RHSA-2024:0409
  • Red Hat CodeReady Linux Builder EUS (v.8.8) oniguruma-devel 6.8.2-2.1.el8_8, oniguruma-debuginfo 6.8.2-2.1.el8_8, oniguruma-debugsource 6.8.2-2.1.el8_8
    fixed: vendor fix RHSA-2024:0572
  • Red Hat Enterprise Linux AppStream (v. 8) oniguruma 6.8.2-2.1.el8_9, ruby 2.5.9-114.module+el8.10.0+23088+750dc6ca, rubygem-pg 1.0.0-3.module+el8.9.0+19193+435404ae, ruby-irb 2.5.9-114.module+el8.10.0+23088+750dc6ca, ruby-libs 2.5.9-114.module+el8.10.0+23088+750dc6ca, rubygem-bson 4.3.0-2.module+el8.9.0+19193+435404ae, +18 more
    fixed: vendor fix RHSA-2025:7539
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) oniguruma 6.8.2-2.1.el8_6
    fixed: vendor fix RHSA-2024:0409
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) oniguruma 6.8.2-2.1.el8_8
    fixed: vendor fix RHSA-2024:0572
show 1 more
  • Red Hat Enterprise Linux 7 php, ruby, php-gd, php-cli, php-dba, php-fpm, +30 more Red Hat Enterprise Linux 8 php, libzip, php-gd, php-cli, php-dba, php-dbg, +30 more Red Hat OpenShift Container Platform 4 oniguruma Red Hat Software Collections rh-php72-php, rh-php73-php, rh-ruby24-ruby, rh-ruby25-ruby, rh-ruby26-ruby, rh-php72-php-gd, +102 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

10.63% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/kkos/oniguruma/issues/164 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/tarantula-team/CVE-2019-19012 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.