Known Vulnerabilities for Oniguruma by Oniguruma Project

Listed below are 10 of the newest known vulnerabilities associated with "Oniguruma" by "Oniguruma Project".

These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.

Data on known vulnerable versions is also displayed based on information from known CPEs

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2019-19246 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match i... 7.5 - HIGH 2019-11-25 2023-11-07
CVE-2019-19204 An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch... 7.5 - HIGH 2019-11-21 2023-11-07
CVE-2019-19203 An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar poi... 7.5 - HIGH 2019-11-21 2023-11-07
CVE-2019-19012 An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds ... 9.8 - CRITICAL 2019-11-17 2023-11-07
CVE-2019-16163 Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. 7.5 - HIGH 2019-09-09 2023-11-07
CVE-2019-13225 A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of serv... 6.5 - MEDIUM 2019-07-10 2023-11-07
CVE-2019-13224 A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclo... 9.8 - CRITICAL 2019-07-10 2023-11-07
CVE-2017-9226 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.... 9.8 - CRITICAL 2017-05-24 2022-07-20
CVE-2017-9225 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.... 9.8 - CRITICAL 2017-05-24 2017-06-02
CVE-2017-9224 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.... 9.8 - CRITICAL 2017-05-24 2022-07-20
Results limited to 10 most recent vulnerabilities

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationOniguruma ProjectOniguruma6.9.6rc4AllAll
ApplicationOniguruma ProjectOniguruma6.9.6rc3AllAll
ApplicationOniguruma ProjectOniguruma6.9.6rc2AllAll
ApplicationOniguruma ProjectOniguruma6.9.6rc1AllAll
ApplicationOniguruma ProjectOniguruma6.9.6-AllAll
ApplicationOniguruma ProjectOniguruma6.9.5-AllAll
ApplicationOniguruma ProjectOniguruma6.9.5rc1AllAll
ApplicationOniguruma ProjectOniguruma6.9.5rc2AllAll
ApplicationOniguruma ProjectOniguruma6.9.5revised_1AllAll
ApplicationOniguruma ProjectOniguruma6.9.4rc3AllAll
ApplicationOniguruma ProjectOniguruma6.9.4rc2AllAll
ApplicationOniguruma ProjectOniguruma6.9.4rc1AllAll
ApplicationOniguruma ProjectOniguruma6.9.4-AllAll
ApplicationOniguruma ProjectOniguruma6.9.3AllAllAll
ApplicationOniguruma ProjectOniguruma6.9.2rc3AllAll
ApplicationOniguruma ProjectOniguruma6.9.2rc2AllAll
ApplicationOniguruma ProjectOniguruma6.9.2rc1AllAll
ApplicationOniguruma ProjectOniguruma6.9.2-AllAll
ApplicationOniguruma ProjectOniguruma6.9.1AllAllAll
ApplicationOniguruma ProjectOniguruma6.9.0AllAllAll
Results limited to 20 most recent known configurations
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report