CVE-2019-19246: High severity Oniguruma Project Oniguruma vulnerability
Last updated 25 August 2025
Other sources
Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercasematch in regexec.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
redhat/onigurumato a version that resolves this vulnerability.Fixed in 6.9.4 - Upgrade
Upgrade
debian/libonigto a version that resolves this vulnerability.Fixed in 6.9.6-1.1Fixed in 6.9.8-1Fixed in 6.9.9-1Fixed in 6.9.10-1 - Upgrade
Upgrade
onigurumato a version that resolves this vulnerability.Patch d3e402928b6eb3327f8f7d59a9edfa622fec557b
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-19246?
CVE-2019-19246 is a vulnerability that exists in Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, which allows for a heap-based buffer over-read.
How does CVE-2019-19246 affect PHP?
CVE-2019-19246 affects PHP 7.3.x by causing a heap-based buffer over-read in the str_lower_case_match function in regexec.c.
What is the severity of CVE-2019-19246?
CVE-2019-19246 has a severity rating of 7.5 (high).
How can CVE-2019-19246 be fixed?
To fix CVE-2019-19246, upgrade to Oniguruma version 6.9.4 or above.
Where can I find more information about CVE-2019-19246?
You can find more information about CVE-2019-19246 at the following references: [1] [2] [3].