CVE-2019-19246

score

<0.1

cvss

7.5

epss

2.9%

published

2019-11-25

kev added

—

first seen

2026-10-21

Oniguruma through 6.9.3, used in PHP 7.3.x and other products, contains a heap-based buffer over-read caused by str_lower_case_match in regexec.c, letting attackers cause denial of service or potentially execute arbitrary code, exploit requires crafted input.