Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pcre | Aug 30, 2017 | Dec 13, 2016 |
| Amazon_linux | — | Upgrade pcreUpgrade glib2 | Jun 9, 2023 | Dec 13, 2016 |
| Debian | — | Upgrade pcre3 | Jul 30, 2024 | Dec 13, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 29, 2015 |
| Freebsd | — | Upgrade pcre | Dec 10, 2025 | Jun 29, 2015 |
| Gentoo Linux | — | Upgrade dev-libs/libpcre. | Oct 30, 2017 | Dec 13, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pcre-develUpgrade pcre | Nov 30, 2017 | Dec 13, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade glib2-develUpgrade glib2 | Jun 17, 2020 | Dec 13, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glib2Upgrade glib2-devel | Apr 30, 2021 | Dec 13, 2016 |
| Oracle Solaris | — | Upgrade library/pcre to version 8.37-0.175.2.13.0.3.0 on Solaris 11.2 | May 29, 2017 | Dec 13, 2016 |
| Oracle_linux | — | Upgrade pcre-develUpgrade pcre-toolsUpgrade pcreUpgrade pcre-static | May 11, 2016 | May 11, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 23, 2015 |
| Suse | — | Upgrade pcre-develUpgrade pcre-devel-staticUpgrade libpcre16-0Upgrade libpcre1-32bitUpgrade sles12sp1-docker-imageUpgrade libpcrecpp0Upgrade libpcrecpp0-32bitUpgrade pcre-toolsUpgrade sles12-docker-imageUpgrade libpcreposix0Upgrade libpcre1 | Dec 13, 2016 | Dec 13, 2016 |
| Ubuntu | — | Upgrade libpcre3 | Apr 4, 2016 | Mar 29, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub