CVE-2019-19012: Debian Linux

Critical severity, CVSS 9.8. EPSS: 10.5% chance of exploitation in the next 30 days.

An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 30 only; version 31 only
• Oniguruma Project Oniguruma: from 6.0.0, up to and including 6.9.3; version 6.9.4 only
• Red Hat Enterprise Linux: version 8.0 only

Published 2019-11-17. Last modified 2026-06-17.