CVE-2009-5155: gnu glibc Data Processing Errors
Vulnerability summary
CVE-2009-5155 is a high (CVSS 7.5) Data Processing Errors vulnerability in gnu glibc. EPSS estimates a 3.91% chance of exploitation in the next 30 days, higher than 90.2% of scored vulnerabilities. 4 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 26-02-2019PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.91%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.91% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
4 foundExploit Reference (debbugs.gnu.org)
Maturity: unknown
Exploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (debbugs.gnu.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu3 products
- eglibcAll versions (No fix recorded)
- glibc< 2.23-0ubuntu11.3 | All versions (No fix recorded)
- gnulibAll versions (No fix recorded)
Debian2 products
- glibc< 2.28-1
- gnulib< 20140202+stable-3.2
Netapp2 products
Gnu1 product
- glibc< 2.28
4 vendors · 8 products
References
16 links- sourceware.org/bugzilla/show_bug.cgi?id=18986X Refsource MISCExploitIssue TrackingThird Party Advisory
- git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272X Refsource MISCMailing ListPatchVendor Advisory
- sourceware.org/bugzilla/show_bug.cgi?id=11053X Refsource MISCExploitIssue TrackingThird Party Advisory
- support.f5.com/csp/article/K64119434X Refsource CONFIRM
