The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pcre3 | Jul 30, 2024 | Jan 14, 2020 |
| Freebsd | — | Upgrade pcre | Dec 10, 2025 | May 22, 2015 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Jan 14, 2020 |
| Oracle Solaris | — | Upgrade library/pcre to version 8.37-0.175.2.13.0.3.0 on Solaris 11.2 | May 29, 2017 | May 29, 2017 |
| Php | — | Upgrade to PHP version 5.6.9Upgrade to PHP version 5.5.26Upgrade to PHP version 5.4.41 | Jan 25, 2023 | Jan 14, 2020 |
| Suse | — | Upgrade pcre2-develUpgrade mariadb-clientUpgrade php7-sysvsemUpgrade php7-opensslUpgrade php7-calendarUpgrade libpcrecpp0Upgrade php7-fastcgiUpgrade php7-xmlrpcUpgrade php7-mbstringUpgrade libpcre2-32-0Upgrade pcre-toolsUpgrade libpcre2-16-0Upgrade mariadbUpgrade php7-sysvshmUpgrade php7-dbaUpgrade php7-ctypeUpgrade php7-zlibUpgrade libmysqld18Upgrade php7-fileinfoUpgrade php72-develUpgrade libmysqlclient18-32bitUpgrade libpcre16-0Upgrade php7-mcryptUpgrade php7-jsonUpgrade php7-pcntlUpgrade mariadb-toolsUpgrade php7-ldapUpgrade libmysqlclient_r18-32bitUpgrade libpcreposix0Upgrade libmysqlclient_r18Upgrade php7-sodiumUpgrade libpcre1-32bitUpgrade php7-readlineUpgrade php7-pspellUpgrade php7-fpmUpgrade php7-mysqlUpgrade mariadb-100-errormessagesUpgrade php7-shmopUpgrade php7-ftpUpgrade libpcre2-8-0Upgrade pcre-develUpgrade php7-intlUpgrade apache2-mod_php7Upgrade php7-wddxUpgrade php7-bcmathUpgrade php7-exifUpgrade php7Upgrade php7-enchantUpgrade libmysqlclient-develUpgrade libmysqlclient18Upgrade php7-tokenizerUpgrade mariadb-errormessagesUpgrade php7-xmlreaderUpgrade php7-pear-archive_tarUpgrade php7-sysvmsgUpgrade libpcre1Upgrade php7-iconvUpgrade php7-gmpUpgrade php7-tidyUpgrade libmysqld-develUpgrade php7-soapUpgrade php7-gdUpgrade php7-embedUpgrade php7-pearUpgrade php7-gettextUpgrade php7-xmlwriterUpgrade php7-opcacheUpgrade php7-imapUpgrade libpcre2-posix2Upgrade php7-bz2Upgrade php7-posixUpgrade php7-odbcUpgrade php7-domUpgrade php7-develUpgrade php7-pgsqlUpgrade libpcrecpp0-32bitUpgrade php7-pdoUpgrade php7-socketsUpgrade php7-pharUpgrade php7-curlUpgrade php7-xslUpgrade php7-snmpUpgrade php7-zipUpgrade php7-sqlite | Dec 18, 2015 | Jul 21, 2015 |
| Ubuntu | — | Upgrade libpcre3 | Apr 4, 2016 | Jul 29, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub