CVE-2019-13225: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days.

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Affected products

• Fedoraproject Fedora: version 29 only; version 30 only
• Oniguruma Project Oniguruma: version 6.9.2 only

Published 2019-07-10. Last modified 2026-06-17.