The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pcre3 | Jul 30, 2024 | Jan 14, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 22, 2015 |
| Freebsd | — | Upgrade pcre | Dec 10, 2025 | May 22, 2015 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Jan 14, 2020 |
| Oracle Solaris | — | Upgrade library/pcre to version 8.37-0.175.2.13.0.3.0 on Solaris 11.2 | May 29, 2017 | May 29, 2017 |
| Php | — | Upgrade to PHP version 5.5.26Upgrade to PHP version 5.6.9Upgrade to PHP version 5.4.41 | Sep 15, 2022 | Jan 14, 2020 |
| Suse | — | Upgrade php7-sysvshmUpgrade mariadb-toolsUpgrade php7-fileinfoUpgrade php7-mcryptUpgrade php7-xmlreaderUpgrade php7-gmpUpgrade php7-xmlrpcUpgrade libpcrecpp0Upgrade libmysqlclient18-32bitUpgrade php7-curlUpgrade pcre2-develUpgrade libmysqlclient_r18-32bitUpgrade php7-bz2Upgrade php7-socketsUpgrade php7-intlUpgrade php7-opcacheUpgrade libmysqlclient-develUpgrade pcre-develUpgrade libpcreposix0Upgrade pcre-toolsUpgrade php7-pspellUpgrade php7-sodiumUpgrade php7-sqliteUpgrade mariadbUpgrade php7-gdUpgrade mariadb-errormessagesUpgrade libpcre2-32-0Upgrade libpcre1-32bitUpgrade php7-calendarUpgrade php7-odbcUpgrade libpcre2-posix2Upgrade php72-develUpgrade libpcre2-8-0Upgrade php7-pearUpgrade php7-ctypeUpgrade php7-zipUpgrade php7-xslUpgrade php7-imapUpgrade php7-mysqlUpgrade php7-dbaUpgrade apache2-mod_php7Upgrade php7-ftpUpgrade php7-soapUpgrade php7-tokenizerUpgrade php7-shmopUpgrade libpcre2-16-0Upgrade php7-gettextUpgrade php7-pharUpgrade libpcre1Upgrade php7-domUpgrade php7-mbstringUpgrade php7-pdoUpgrade php7Upgrade php7-pgsqlUpgrade php7-zlibUpgrade sles12-docker-imageUpgrade php7-pcntlUpgrade php7-jsonUpgrade php7-tidyUpgrade php7-xmlwriterUpgrade libpcre16-0Upgrade php7-sysvmsgUpgrade php7-sysvsemUpgrade libmysqlclient18Upgrade php7-ldapUpgrade php7-opensslUpgrade php7-fpmUpgrade php7-embedUpgrade php7-exifUpgrade libmysqld18Upgrade php7-fastcgiUpgrade php7-iconvUpgrade php7-readlineUpgrade php7-pear-archive_tarUpgrade mariadb-clientUpgrade php7-snmpUpgrade php7-bcmathUpgrade libpcrecpp0-32bitUpgrade php7-enchantUpgrade php7-wddxUpgrade sles12sp1-docker-imageUpgrade libmysqld-develUpgrade mariadb-100-errormessagesUpgrade php7-posixUpgrade pcre-devel-staticUpgrade php7-develUpgrade libmysqlclient_r18 | Dec 18, 2015 | Jul 29, 2015 |
| Ubuntu | — | Upgrade libpcre3 | Apr 4, 2016 | Jul 29, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub