{"id":"CVE-2019-6293","aliases":["AZL-40794","AZL-6424","DEBIAN-CVE-2019-6293","EUVD-2019-15858","GHSA-grpp-mcmx-p7pc","JLSEC-2026-1293","UBUNTU-CVE-2019-6293"],"status":"published","title":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is...","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01601,"percentile":0.75978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2019-01-15T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"flex","fixed_in":["2.6.4-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"flex","fixed_in":["2.6.4-7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2"]},{"source":"osv","ecosystem":"Debian:13","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2"]},{"source":"osv","ecosystem":"Debian:14","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2"]},{"source":"osv","ecosystem":"Julia","package":"flex_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.39-8","2.6.0-1","2.6.0-3","2.6.0-4","2.6.0-6","2.6.0-7","2.6.0-8","2.6.0-9","2.6.0-11"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1-1.3","2.6.4-1","2.6.4-2","2.6.4-3","2.6.4-4","2.6.4-5","2.6.4-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-6.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8build1","2.6.4-8build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2","2.6.4-8.2build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-8.2build1","2.6.4-8.2build2"]}],"products":[{"vendor":"westes","product":"flex"}],"references":[{"url":"https://github.com/westes/flex/issues/414","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6293","tags":["web"]},{"url":"https://github.com/advisories/GHSA-grpp-mcmx-p7pc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6293","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-6293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6293","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-6293","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:00:00Z","modified":"2024-09-16T22:30:16.991Z","updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-15858","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:00:00Z","modified":"2024-09-16T22:30:16Z","updated_at":"2026-11-03T00:55:02.424132Z"}],"ghsa":[{"id":"GHSA-grpp-mcmx-p7pc","title":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is...","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2022-05-13T01:22:41Z","modified":"2023-02-01T05:07:12Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:50:30.001937Z"}],"nvd":[{"id":"CVE-2019-6293","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:29:00.523Z","modified":"2026-06-17T02:38:57.997Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"AZL-40794","title":"CVE-2019-6293 affecting package flex for versions less than 2.6.4-7","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:29:00Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-6424","title":"CVE-2019-6293 affecting package flex for versions less than 2.6.4-7","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:29:00Z","modified":"2026-04-21T04:32:20.802712Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"CVE-2019-6293","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:29:00.523Z","modified":"2026-10-20T10:51:40.745909017Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6293","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:29:00.523Z","modified":"2026-09-21T07:02:57.708277162Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"JLSEC-2026-1293","description":"An issue was discovered in the function `mark_beginning_as_normal` in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the `mark_beginning_as_normal` function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2026-08-13T10:57:26.913Z","modified":"2026-08-13T11:00:03.460562063Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2019-6293","description":"An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.","status":"published","published":"2019-01-15T00:29:00Z","modified":"2026-10-17T12:55:50.194128131Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:21.741399Z"}]}}