https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-19246.htmlhttps://patchthecve.com/cve/CVE-2019-19246.htmlWed, 17 Jun 2026 02:26:21 +0000HIGH 7.5: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.https://patchthecve.com/cve/CVE-2019-19204.htmlhttps://patchthecve.com/cve/CVE-2019-19204.htmlWed, 17 Jun 2026 02:26:17 +0000HIGH 7.5: An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.https://patchthecve.com/cve/CVE-2019-19203.htmlhttps://patchthecve.com/cve/CVE-2019-19203.htmlWed, 17 Jun 2026 02:26:16 +0000HIGH 7.5: An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.https://patchthecve.com/cve/CVE-2019-19012.htmlhttps://patchthecve.com/cve/CVE-2019-19012.htmlWed, 17 Jun 2026 02:25:58 +0000CRITICAL 9.8: An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or https://patchthecve.com/cve/CVE-2019-13225.htmlhttps://patchthecve.com/cve/CVE-2019-13225.htmlWed, 17 Jun 2026 02:16:19 +0000MEDIUM 6.5: A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.https://patchthecve.com/cve/CVE-2019-13224.htmlhttps://patchthecve.com/cve/CVE-2019-13224.htmlWed, 17 Jun 2026 02:16:19 +0000CRITICAL 9.8: A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte https://patchthecve.com/cve/CVE-2017-9229.htmlhttps://patchthecve.com/cve/CVE-2017-9229.htmlWed, 17 Jun 2026 01:27:43 +0000HIGH 7.5: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer https://patchthecve.com/cve/CVE-2017-9228.htmlhttps://patchthecve.com/cve/CVE-2017-9228.htmlWed, 17 Jun 2026 01:27:43 +0000CRITICAL 9.8: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrechttps://patchthecve.com/cve/CVE-2017-9227.htmlhttps://patchthecve.com/cve/CVE-2017-9227.htmlWed, 17 Jun 2026 01:27:42 +0000CRITICAL 9.8: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid poihttps://patchthecve.com/cve/CVE-2017-9226.htmlhttps://patchthecve.com/cve/CVE-2017-9226.htmlWed, 17 Jun 2026 01:27:42 +0000CRITICAL 9.8: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token()https://patchthecve.com/cve/CVE-2017-9225.htmlhttps://patchthecve.com/cve/CVE-2017-9225.htmlWed, 17 Jun 2026 01:27:42 +0000CRITICAL 9.8: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unihttps://patchthecve.com/cve/CVE-2017-9224.htmlhttps://patchthecve.com/cve/CVE-2017-9224.htmlWed, 17 Jun 2026 01:27:42 +0000CRITICAL 9.8: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an