Description
A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libonig | 6.9.2-1 | — |
| Debian 13 | libonig | 6.9.2-1 | — |
| Debian 12 | libonig | 6.9.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apcu-panel +2 | 5.1.17-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 8 | libzip +2 | 1.5.2-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 8 | oniguruma +1 | 6.8.2-2.el8 | RHSA-2020:4827 |
| RHEL 8 | php +25 | 7.3.20-1.module+el8.2.0+7373+b272fdef | RHSA-2020:3662 |
| RHEL 8 | php-pear | 1:1.10.9-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 8 | php-pecl-rrd | 2.0.1-1.module+el8.2.0+4968+1d5097db | RHSA-2020:3662 |
| RHEL 8 | php-pecl-xdebug | 2.8.0-1.module+el8.2.0+4968+1d5097db | RHSA-2020:3662 |
| RHEL 8 | php-pecl-zip | 1.15.4-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | apcu-panel +2 | 5.1.17-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | libzip +2 | 1.5.2-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | oniguruma +1 | 6.8.2-2.el8 | ALSA-2020:4827 |
| AlmaLinux 8 | php +25 | 7.3.20-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pear | 1:1.10.9-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pecl-rrd | 2.0.1-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pecl-xdebug | 2.8.0-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pecl-zip | 1.15.4-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libzip | 1.5.2-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | oniguruma | 6.8.2-2.el8 | RLSA-2020:4827 |
| Rocky Linux 8 | php | 7.3.20-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pear | 1:1.10.9-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-apcu | 5.1.17-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-xdebug | 2.8.0-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-zip | 1.15.4-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
| SLES 15 SP5 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
| SLE Micro 5.4 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
| SLE Micro 5.3 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
| SLE Micro 5.2 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
| SLE Micro 5.1 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | oniguruma | 6.9.7.1-1.2 | openSUSE-SU-2024:11111-1 |
| openSUSE Leap 15.6 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
| openSUSE Leap 15.5 | oniguruma | 6.7.0-150000.3.6.1 | SUSE-SU-2024:2401-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | oniguruma +1 | 5.9.6-1.amzn2.0.1 | ALAS2-2019-1288 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apcu-panel +2 | 5.1.17-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | libzip +2 | 1.5.2-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | oniguruma +1 | 6.8.2-2.el8 | ELSA-2020-4827 |
| Oracle Linux 8 | php +25 | 7.3.20-1.module+el8.2.0+7784+4033621d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pear | 1:1.10.9-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pecl-xdebug | 2.8.0-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pecl-zip | 1.15.4-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 7 | OVMF +1 | 1:1.3.2-1.el7 | ELSA-2020-5861 |
Advisories 12
- ALSA-2020:4827 Moderate: oniguruma security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2020:3662 Moderate: php:7.3 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2020:3662 Red Hat Security Advisory: php:7.3 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 18, 2026
- RHSA-2020:4827 Red Hat Security Advisory: oniguruma security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RLSA-2020:4827 Moderate: oniguruma security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2020:3662 Moderate: php:7.3 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:2401-1 Security update for oniguruma SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11111-1 libonig5-6.9.7.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2020-4827 Moderate: oniguruma security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
- ELSA-2020-5861 Important: edk2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 29, 2020
- ELSA-2020-3662 Moderate: php:7.3 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 9, 2020
- ALAS2-2019-1288 Moderate: oniguruma security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 19, 2019
References
- https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c
- FEDORA-2019-3f3d0953db vendor-advisory
- FEDORA-2019-5409bb5e68 vendor-advisory
- GLSA-201911-03 vendor-advisory