CVE-2019-6293

An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.

Score

CVSS 3.0 5.5 Medium

Status

Modified - cve@mitre.org

Published

2019-01-15

Last modified

2024-09-16

Weaknesses

CWE-674

Affected products

• Flex (Westes)

References

• https://github.com/westes/flex/issues/414