The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-pcre3 | Jul 30, 2024 | Jan 14, 2020 | |
| Mariadb Mariadb | mariadb-mariadb-upgrade-latest | Mar 4, 2025 | Jan 14, 2020 | |
| Oracle Solaris | oracle-solaris-11-2-upgrade-library-pcre-8-37-0-175-2-13-0-3-0 | May 29, 2017 | May 29, 2017 | |
| Php | php-upgrade-5_4_41php-upgrade-5_5_26php-upgrade-5_6_9 | Jan 25, 2023 | Jan 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub