CVE-2018-20796
published 2019-02-26CVE-2018-20796: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by…
PriorityP337high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
5.80%
92.3th percentile
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | — | — |
| gnu | glibc | <= 2.29 | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_glibc_2.28-12_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7x29-5q3f-f4x2: In the GNU C Library (aka glibc or libc6) through 2
ghsa_unreviewed·2022-05-13
CVE-2018-20796 [HIGH] CWE-674 GHSA-7x29-5q3f-f4x2: In the GNU C Library (aka glibc or libc6) through 2
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
GHSA
GHSA-v5rq-2q5p-p82v: ** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2019-9192 [HIGH] CWE-674 GHSA-v5rq-2q5p-p82v: ** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2
** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.
OSV
CVE-2018-20796: In the GNU C Library (aka glibc or libc6) through 2
osv·2019-02-26·CVSS 7.5
CVE-2018-20796 [HIGH] CVE-2018-20796: In the GNU C Library (aka glibc or libc6) through 2
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
OSV
CVE-2019-9192: In the GNU C Library (aka glibc or libc6) through 2
osv·2019-02-26·CVSS 7.5
CVE-2019-9192 [HIGH] CVE-2019-9192: In the GNU C Library (aka glibc or libc6) through 2
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
Red Hat
glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
vendor_redhat·2019-02-26·CVSS 7.5
CVE-2019-9192 [HIGH] CWE-674 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
Upstream glibc does not classify this bug as a security issue as per: https://sourceware.org/glibc/wiki/Security%20Exceptions
Package: glibc (Red Hat Enterprise Linux 6) - Not affected
Package: glibc (Red Hat Enterprise Linux 7) - Not affected
Package: glibc (Red Hat Enterprise Linux 8) - Not affected
Microsoft
In the GNU C Library (aka glibc or libc6) through 2.29 check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
vendor_msrc·2019-02-12·CVSS 7.5
CVE-2018-20796 [HIGH] CWE-674 In the GNU C Library (aka glibc or libc6) through 2.29 check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
In the GNU C Library (aka glibc or libc6) through 2.29 check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflec
Red Hat
glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
vendor_redhat·2019-01-20·CVSS 7.5
CVE-2018-20796 [HIGH] CWE-674 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Statement: The regular expression compiler in glibc is only supposed to be exposed to trusted content, therefore this flaw is not classified as a security vulnerability.
Package: glibc (Red Hat Enterprise Linux 6) - Not affected
Package: glibc (Red Hat Enterprise Linux 7) - Not affected
Package: glibc (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2019-9192: glibc - In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_po...
vendor_debian·2019·CVSS 7.5
CVE-2019-9192 [HIGH] CVE-2019-9192: glibc - In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_po...
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Debian
CVE-2018-20796: glibc - In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_po...
vendor_debian·2018·CVSS 7.5
CVE-2018-20796 [HIGH] CVE-2018-20796: glibc - In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_po...
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-9192 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
bugzilla·2019-03-01·CVSS 7.5
CVE-2019-9192 [HIGH] CVE-2019-9192 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
CVE-2019-9192 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
In the GNU C Library (aka glibc) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796.
NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.
Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=24269
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1684375]
---
Upstream does not classify this as a security flaw as per:
https://sourceware.org/glibc/wiki/Security%20Exceptions
"Consequently, resource exhaustion issues which can be triggered only with crafted pat
Bugzilla
CVE-2018-20796 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
bugzilla·2019-02-26·CVSS 7.5
CVE-2018-20796 [HIGH] CVE-2018-20796 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
CVE-2018-20796 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Reference:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1683153]
---
The regular expression compiler in glibc is only supposed to be exposed to trusted content, so this is not a security vulnerability:
“resource exhaustion issues which can be triggered only with crafted patterns (either during compilation or execution) are not treated as security bugs”
---
Statement:
The regular expression compiler in gl
Bugzilla
CVE-2018-20796 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c [fedora-all]
bugzilla·2019-02-26·CVSS 7.5
CVE-2018-20796 [HIGH] CVE-2018-20796 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c [fedora-all]
CVE-2018-20796 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this is
http://www.securityfocus.com/bid/107160https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.htmlhttps://security.netapp.com/advisory/ntap-20190315-0002/https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSShttp://www.securityfocus.com/bid/107160https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.htmlhttps://security.netapp.com/advisory/ntap-20190315-0002/https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
2019-02-26
Published