{"id":"CVE-2020-26159","aliases":["ALPINE-CVE-2020-26159","EUVD-2020-18785","GHSA-jcjp-j466-5xxg","MGASA-2020-0452","SUSE-SU-2022:3327-1","SUSE-SU-2024:2993-1","openSUSE-SU-2024:11111-1"],"status":"rejected","title":"In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2020-09-30T12:41:13Z","modified":"2026-10-26T11:17:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"oniguruma","fixed_in":["6.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"oniguruma","fixed_in":["6.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"oniguruma","fixed_in":["6.9.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"oniguruma","fixed_in":["6.9.4-r1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"oniguruma","fixed_in":["6.9.4-1.1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"oniguruma","fixed_in":["5.9.2-13.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"oniguruma","fixed_in":["5.9.2-13.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"oniguruma","fixed_in":["5.9.2-13.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1.1.mga7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-150000.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.2-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.2-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.2-13.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7.1-1.2"}]}],"bundled":7}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26159"},{"url":"https://github.com/kkos/oniguruma/issues/207"},{"url":"https://github.com/kkos/oniguruma/commit/cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0"},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00025.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ZCUPCKJNSUHQMXXZBRNDDGQQLBJ2ACT/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4NHVR7X5ZLXUGW3PBCPQMNFQ3OJCSMQD/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUJY7BUIFBTZ3IUHVHCID4JYCRDGKPS/"},{"url":"http://www.openwall.com/lists/oss-security/2020/09/30/7"},{"url":"https://github.com/advisories/GHSA-jcjp-j466-5xxg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-26159","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0452.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27387","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZFUJY7BUIFBTZ3IUHVHCID4JYCRDGKPS/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2431","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2020/09/30/7","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223327-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142847","tags":["report"]},{"url":"https://bugzilla.suse.com/1150130","tags":["report"]},{"url":"https://bugzilla.suse.com/1157805","tags":["report"]},{"url":"https://bugzilla.suse.com/1164550","tags":["report"]},{"url":"https://bugzilla.suse.com/1164569","tags":["report"]},{"url":"https://bugzilla.suse.com/1177179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26159","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242993-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19012","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26159","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none","status":"rejected","published":"2020-09-30T12:41:13Z","modified":"2021-02-02T20:16:32Z","updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-18785","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none","status":"published","published":"2020-09-30T12:41:13Z","modified":"2021-02-02T20:16:32Z","updated_at":"2026-11-03T03:51:18.030777Z"}],"ghsa":[{"id":"GHSA-jcjp-j466-5xxg","title":"In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be...","description":"In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat_opt_exact_str in src/regcomp.c .","status":"published","published":"2022-05-24T17:29:52Z","modified":"2023-01-29T05:04:01Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:45:27.507739Z"}],"nvd":[{"id":"CVE-2020-26159","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none","status":"rejected","published":"2020-09-30T21:15:13.357Z","modified":"2023-11-07T03:20:30.767Z","updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"ALPINE-CVE-2020-26159","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none","status":"published","published":"2020-09-30T21:15:13.357Z","modified":"2026-10-26T11:17:55.160157596Z","updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-26159","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none","status":"published","published":"2020-09-30T21:15:13Z","modified":"2026-04-16T04:37:07.049158898Z","updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"MGASA-2020-0452","title":"Updated oniguruma packages fix security vulnerability","description":"In Oniguruma, an attacker able to supply a regular expression for compilation\nmay be able to overflow a buffer by one byte in concat_opt_exact_str in\nsrc/regcomp.c (CVE-2020-26159).\n","status":"published","published":"2020-12-08T10:40:32Z","modified":"2026-04-16T04:41:04.771235957Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11111-1","title":"libonig5-6.9.7.1-1.2 on GA media","description":"These are all security issues fixed in the libonig5-6.9.7.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:06.725105Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2022:3327-1","title":"Security update for oniguruma","description":"This update for oniguruma fixes the following issues:\n\n- CVE-2019-19246: Fixed an out of bounds access during regular\n  expression matching (bsc#1157805).\n- CVE-2019-19204: Fixed an out of bounds access when compiling a\n  crafted regular expression (bsc#1164569).\n- CVE-2019-19203: Fixed an out of bounds access when performing a\n  string search (bsc#1164550).\n- CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling\n  a crafted regular expression, which could lead to denial of service (bsc#1150130).\n- CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179).\n- CVE-2019-13224: Fixed a potential use-after-free when handling\n  multiple different encodings (bsc#1142847).\n","status":"published","published":"2022-09-21T10:47:37Z","modified":"2026-02-04T04:22:24.013432Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2024:2993-1","title":"Security update for oniguruma","description":"This update for oniguruma fixes the following issues:\n\n- CVE-2020-26159: Fixed buffer overflow in concat_opt_exact_str could that could lead in DoS (bsc#1177179)\n","status":"published","published":"2024-08-21T10:37:46Z","modified":"2026-02-04T04:28:32.922417Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}