Every CVE Search/ Get API key

CVE-2019-9192

** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29,...

7.5 HighFix availableDisputed

CVE-2019-9192 is a high vulnerability (CVSS 7.5) in Gnu Glibc, published February 26, 2019. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in glibc 2.36-9+deb12u14.root.io.18.

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.45%Up 1.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Record
CVE-2019-9192
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-674
Updated
2026-11-02
CVE List No score

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Record
CVE-2019-9192
Updated
2026-11-02
EUVDEUVD-2019-18569 No score

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Record
EUVD-2019-18569
Updated
2026-11-03
GitHub AdvisoriesGHSA-v5rq-2q5p-p82v 7.5

** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29,...

** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.

Record
GHSA-v5rq-2q5p-p82v
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
OSVBELL-CVE-2019-9192 7.5

CVE-2019-9192 does not affect BellSoft software

Record
BELL-CVE-2019-9192
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Record
CVE-2019-9192
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-9192 7.5

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Record
DEBIAN-CVE-2019-9192
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2019-9192 No score

CVE-2019-9192 in glibc - Patched by Root

Root has patched CVE-2019-9192 in the glibc package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2019-9192
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2019-9192 No score

CVE-2019-9192 in glibc - Patched by Root

Root has patched CVE-2019-9192 in the glibc package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2019-9192
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glibc
Debian:12
 All versions, plus listed versions
2.36-10~02.36-92.36-9+deb12u12.36-9+deb12u102.36-9+deb12u11
Show 45 moreShow less
2.36-9+deb12u122.36-9+deb12u132.36-9+deb12u142.36-9+deb12u22.36-9+deb12u32.36-9+deb12u42.36-9+deb12u52.36-9+deb12u62.36-9+deb12u72.36-9+deb12u82.36-9+deb12u92.36-9+loong642.37-12.37-102.37-112.37-122.37-132.37-142.37-152.37-15.12.37-15.1+sh42.37-15~deb13u12.37-162.37-172.37-182.37-192.37-22.37-32.37-42.37-52.37-62.37-72.37-82.37-92.38-12.38-102.38-112.38-122.38-12.12.38-132.38-142.38-15~02.38-15~12.38-22.38-3
 None known
glibc
Debian:13
 All versions, plus listed versions
2.41-122.41-12+deb13u12.41-12+deb13u22.41-12+deb13u32.41-12+deb13u4
Show 34 moreShow less
2.41-13~hurd.02.41-13~hurd.12.42-12.42-102.42-112.42-122.42-12~hurd.12.42-132.42-142.42-14~hurd.12.42-152.42-15~hurd.12.42-162.42-172.42-22.42-32.42-42.42-52.42-62.42-72.42-82.42-8~hurd.12.42-8~hurd.22.42-92.43-12.43-22.43-32.43-3+m68k2.43-42.43-4+m68k2.43-52.43-62.44-12.44-2
 None known
glibc
Debian:14
 All versions, plus listed versions
2.41-122.41-13~hurd.02.41-13~hurd.12.42-12.42-10
Show 30 moreShow less
2.42-112.42-122.42-12~hurd.12.42-132.42-142.42-14~hurd.12.42-152.42-15~hurd.12.42-162.42-172.42-22.42-32.42-42.42-52.42-62.42-72.42-82.42-8~hurd.12.42-8~hurd.22.42-92.43-12.43-22.43-32.43-3+m68k2.43-42.43-4+m68k2.43-52.43-62.44-12.44-2
 None known
glibc
Root:Debian:12
 before 2.36-9+deb12u14.root.io.18
2.36-9+deb12u14.root.io.182.36-9+deb12u14.root.io.192.36-9+deb12u14.aikido.202.36-9+deb12u14.aikido.212.36-9+deb12u14.aikido.222.36-9+deb12u14.aikido.23
rootio-glibc
Root:Debian:12
 before 2.36-9+deb12u14.root.io.18
2.36-9+deb12u14.root.io.182.36-9+deb12u14.root.io.192.36-9+deb12u14.aikido.202.36-9+deb12u14.aikido.212.36-9+deb12u14.aikido.222.36-9+deb12u14.aikido.23
glibc
Root:Debian:13
 before 2.41-12+deb13u4.aikido.13
2.41-12+deb13u4.aikido.132.41-12+deb13u4.aikido.14
rootio-glibc
Root:Debian:13
 before 2.41-12+deb13u4.aikido.13
2.41-12+deb13u4.aikido.132.41-12+deb13u4.aikido.14

History

History
WhenChangedSources
2026-11-03affectedOSV
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 83 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open