{"id":"CVE-2019-9169","title":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.","summary":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-125"],"vendor":"gnu","product":"glibc","affected":["glibc <= 2.29","cloud_backup","ontap_select_deploy_administration_utility","steelstore_cloud_integrated_storage","web_gateway >= 7.7.2.0, < 7.7.2.21","web_gateway >= 7.8.2.0, < 7.8.2.8","web_gateway >= 8.0.0, < 8.1.1","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 19.10"],"patched":["web_gateway 8.1.1"],"published":"2019-02-26","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:56.987","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","references":[{"url":"http://www.securityfocus.com/bid/107160","label":"cve@mitre.org"},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","label":"cve@mitre.org"},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","label":"cve@mitre.org"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10278","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202006-04","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190315-0002/","label":"cve@mitre.org"},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=24114","label":"cve@mitre.org"},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","label":"cve@mitre.org"},{"url":"https://support.f5.com/csp/article/K54823184","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4416-1/","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/107160","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10278","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202006-04","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190315-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=24114","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K54823184","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4416-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-9169.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-9169"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684057"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9169"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169"},{"url":"https://access.redhat.com/errata/RHSA-2021:1585"}],"tags":["nvd","csaf","vex","red-hat","score-dispute"],"epss":0.04731,"epssPercentile":0.91655,"ingestedAt":"2026-10-14T07:21:04.806Z","scores":{"nvd":9.8,"vendor":6.5},"slug":"CVE-2019-9169","body":"## Overview\n\nIn the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.\n\n## Affected\n\n- `glibc <= 2.29`\n- `cloud_backup`\n- `ontap_select_deploy_administration_utility`\n- `steelstore_cloud_integrated_storage`\n- `web_gateway >= 7.7.2.0, < 7.7.2.21`\n- `web_gateway >= 7.8.2.0, < 7.8.2.8`\n- `web_gateway >= 8.0.0, < 8.1.1`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 19.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `web_gateway 8.1.1`\n\n## Vendor advisories\n\n- **RHSA-2021:1585** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2021-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2021:1585)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-9169.json)","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":53.9,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}