Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tcl-develUpgrade tcl-htmlUpgrade tcl | Dec 1, 2016 | Jan 9, 2008 |
| Freebsd | — | Upgrade postgresqlUpgrade postgresql-server | Dec 10, 2025 | Apr 24, 2008 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Jan 9, 2008 |
| Oracle_linux | — | Upgrade postgresql-tclUpgrade tcl-develUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-pythonUpgrade tcl-htmlUpgrade postgresql-plUpgrade postgresql-serverUpgrade postgresql-libsUpgrade tclUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-contrib | Oct 16, 2024 | Jan 9, 2008 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 7, 2008 |
| Suse | — | Upgrade postgresql91-docsUpgrade postgresql91-serverUpgrade postgresql94-docsUpgrade postgresql91Upgrade libpq5-32bitUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql94-contribUpgrade postgresql-libs-32bitUpgrade postgresql94-develUpgrade postgresql91-contribUpgrade libpq5Upgrade libecpg6Upgrade postgresqlUpgrade postgresql94-serverUpgrade postgresql-docsUpgrade postgresql94Upgrade postgresql-libs-x86Upgrade postgresql-serverUpgrade postgresql-libs | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade postgresql-pltcl-8.2Upgrade postgresql-8.1Upgrade postgresql-pltcl-8.1Upgrade postgresql-8.2 | Nov 8, 2024 | Jan 9, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub