CVE-2019-13224: canonical ubuntu_linux Use After Free
Vulnerability summary
CVE-2019-13224 is a critical (CVSS 9.8) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 4.05% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 2Timeline
- 10-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.05%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.05% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu5 products
- groongaAll versions (No fix recorded)
- libevhtpAll versions (No fix recorded)
- libonig< 5.9.1-1ubuntu1.1+esm1 | < 5.9.6-1ubuntu0.1+esm1 | < 6.7.0-1ubuntu0.1~esm1 | < 6.9.2-1
- mudletAll versions (No fix recorded)
- php5< 5.5.9+dfsg-1ubuntu4.29+esm4
Debian2 products
- libonig< 6.9.2-1 | < 5.9.5-3.2+deb8u2
- debian_linuxEOL8.0
Alpine1 product
- php7< 7.3.9-r0 | < 7.1.32-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04
Fedoraproject1 product
- fedoraEOL29 | 30
Oniguruma_project1 product
- onigurumaEOL6.9.2
Php1 product
- php≥ 7.1.0, < 7.1.32 | ≥ 7.2.0, < 7.2.23 | ≥ 7.3.0, < 7.3.9
7 vendors · 12 products
References
13 links- github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55X Refsource CONFIRMPatchThird Party AdvisoryREPORT
lists.debian.org/debian-lts-announce/2019/07/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory