Every CVE Search/ Get API key

CVE-2020-26159

In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be...

No scoreFix availableRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

What each source reports

CVE List No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

Record
CVE-2020-26159
Updated
2026-11-02
EUVDEUVD-2020-18785 No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

Record
EUVD-2020-18785
Updated
2026-11-03
GitHub AdvisoriesGHSA-jcjp-j466-5xxg No score

In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be...

In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat_opt_exact_str in src/regcomp.c .

Record
GHSA-jcjp-j466-5xxg
Weakness
CWE-787
Updated
2026-11-02
NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

Record
CVE-2020-26159
Updated
2026-11-02
OSVALPINE-CVE-2020-26159 No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

Record
ALPINE-CVE-2020-26159
Updated
2026-11-02
OSV No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

Record
CVE-2020-26159
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2020-0452 No score

Updated oniguruma packages fix security vulnerability

In Oniguruma, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat_opt_exact_str in src/regcomp.c (CVE-2020-26159).

Record
MGASA-2020-0452
Updated
2026-11-02
OSVopenSUSE-SU-2024:11111-1 No score

libonig5-6.9.7.1-1.2 on GA media

These are all security issues fixed in the libonig5-6.9.7.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11111-1
Updated
2026-11-02
OSVSUSE-SU-2022:3327-1 No score

Security update for oniguruma

This update for oniguruma fixes the following issues:

  • CVE-2019-19246: Fixed an out of bounds access during regular expression matching (bsc#1157805).
  • CVE-2019-19204: Fixed an out of bounds access when compiling a crafted regular expression (bsc#1164569).
  • CVE-2019-19203: Fixed an out of bounds access when performing a string search (bsc#1164550).
  • CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling a crafted regular expression, which could lead to denial of service (bsc#1150130).
  • CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179).
  • CVE-2019-13224: Fixed a potential use-after-free when handling multiple different encodings (bsc#1142847).
Record
SUSE-SU-2022:3327-1
Updated
2026-11-02
OSVSUSE-SU-2024:2993-1 No score

Security update for oniguruma

This update for oniguruma fixes the following issues:

  • CVE-2020-26159: Fixed buffer overflow in concat_opt_exact_str could that could lead in DoS (bsc#1177179)
Record
SUSE-SU-2024:2993-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
oniguruma
Alpine:v3.10
 before 6.9.4-r1
6.9.4-r1
oniguruma
Alpine:v3.11
 before 6.9.4-r1
6.9.4-r1
oniguruma
Alpine:v3.12
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.13
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.14
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.15
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.16
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.17
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.18
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.19
 before 6.9.5-r2
6.9.5-r2
Show 33 moreShow less
Affected packages
PackageAffectedFixed
oniguruma
Alpine:v3.20
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.21
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.22
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.23
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.24
 before 6.9.5-r2
6.9.5-r2
oniguruma
Alpine:v3.9
 before 6.9.4-r1
6.9.4-r1
oniguruma
Mageia:7
 before 6.9.4-1.1.mga7
6.9.4-1.1.mga7
oniguruma
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Manager Proxy 4.1
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Manager Server 4.1
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Enterprise Storage 6
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Enterprise Storage 7
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
openSUSE:Leap Micro 5.2
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
openSUSE:Leap 15.3
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
openSUSE:Leap 15.4
From an advisory covering 6 CVEs
 before 6.7.0-150000.3.3.1
6.7.0-150000.3.3.1
oniguruma
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 5.9.2-13.6.1
5.9.2-13.6.1
oniguruma
SUSE:Linux Enterprise Server 12 SP5
 before 5.9.2-13.6.1
5.9.2-13.6.1
oniguruma
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 5.9.2-13.6.1
5.9.2-13.6.1
oniguruma
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 6.9.7.1-1.2
6.9.7.1-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-26159 has been rejected by its source and should not be treated as a live vulnerability, published September 30, 2020. Fixed in oniguruma 6.9.4-r1.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open