Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tcl-develUpgrade tcl-htmlUpgrade tcl | Dec 1, 2016 | Jan 9, 2008 |
| Freebsd | — | Upgrade postgresqlUpgrade postgresql-server | Dec 10, 2025 | Apr 24, 2008 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | Jan 9, 2008 |
| Oracle_linux | — | Upgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-testUpgrade tcl-htmlUpgrade postgresql-tclUpgrade postgresql-serverUpgrade postgresql-pythonUpgrade postgresql-plUpgrade tcl-develUpgrade tclUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-contrib | Oct 16, 2024 | Jan 9, 2008 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 7, 2008 |
| Suse | — | Upgrade postgresql-docsUpgrade postgresql94-serverUpgrade postgresqlUpgrade libpq5Upgrade postgresql-libsUpgrade libecpg6Upgrade postgresql-libs-x86Upgrade postgresql94Upgrade postgresql-serverUpgrade postgresql91-docsUpgrade postgresql-libs-32bitUpgrade postgresql91Upgrade postgresql94-docsUpgrade postgresql94-develUpgrade libpq5-32bitUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql94-contribUpgrade postgresql91-serverUpgrade postgresql91-contrib | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade postgresql-8.2Upgrade postgresql-8.1Upgrade postgresql-pltcl-8.2Upgrade postgresql-pltcl-8.1 | Nov 8, 2024 | Jan 9, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub