CVE-2019-9169
criticalIn the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitiv…
Vendor / product: Gnu — glibc
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-02-26 02:29
Modified: 2026-10-14 07:16
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
gnu / glibc ≤2.29
netapp / cloud_backup all versions
netapp / ontap_select_deploy_administration_utility all versions
netapp / steelstore_cloud_integrated_storage all versions
mcafee / web_gateway ≥7.7.2.0 <7.7.2.21, ≥7.8.2.0 <7.8.2.8, ≥8.0.0 <8.1.1
canonical / ubuntu_linux 16.04, 18.04, 19.10
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140
Vendor advisory: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142
Vendor advisory: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140
Vendor advisory: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142
Patch / mitigation: https://security.netapp.com/advisory/ntap-20190315-0002/
Patch / mitigation: https://sourceware.org/bugzilla/show_bug.cgi?id=24114
Patch / mitigation: https://security.netapp.com/advisory/ntap-20190315-0002/
Patch / mitigation: https://sourceware.org/bugzilla/show_bug.cgi?id=24114
References
- http://www.securityfocus.com/bid/107160 cve@mitre.org
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 cve@mitre.org
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 cve@mitre.org
- https://kc.mcafee.com/corporate/index?page=content&id=SB10278 cve@mitre.org
- https://security.gentoo.org/glsa/202006-04 cve@mitre.org
- https://security.netapp.com/advisory/ntap-20190315-0002/ cve@mitre.org
- https://sourceware.org/bugzilla/show_bug.cgi?id=24114 cve@mitre.org
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b83303717524723... cve@mitre.org
- https://support.f5.com/csp/article/K54823184 cve@mitre.org
- https://usn.ubuntu.com/4416-1/ cve@mitre.org
- https://www.oracle.com/security-alerts/cpuapr2022.html cve@mitre.org
- http://www.securityfocus.com/bid/107160 af854a3a-2127-422b-91ae-364da2661108
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 af854a3a-2127-422b-91ae-364da2661108
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 af854a3a-2127-422b-91ae-364da2661108
- https://kc.mcafee.com/corporate/index?page=content&id=SB10278 af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/202006-04 af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20190315-0002/ af854a3a-2127-422b-91ae-364da2661108
- https://sourceware.org/bugzilla/show_bug.cgi?id=24114 af854a3a-2127-422b-91ae-364da2661108
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b83303717524723... af854a3a-2127-422b-91ae-364da2661108
- https://support.f5.com/csp/article/K54823184 af854a3a-2127-422b-91ae-364da2661108
- https://usn.ubuntu.com/4416-1/ af854a3a-2127-422b-91ae-364da2661108
- https://www.oracle.com/security-alerts/cpuapr2022.html af854a3a-2127-422b-91ae-364da2661108
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗