libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pcre | Aug 22, 2024 | Mar 20, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 20, 2017 |
| Debian | — | Upgrade pcre3Upgrade pcre2 | Jul 30, 2024 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade dev-libs/libpcre.Upgrade dev-libs/libpcre2. | Oct 30, 2017 | Mar 19, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pcreUpgrade pcre-devel | Mar 27, 2019 | Mar 19, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pcre-develUpgrade pcre | Aug 16, 2019 | Mar 20, 2017 |
| Oracle Solaris | — | Upgrade library/pcre to version 8.41-0.175.3.23.0.3.0 on Solaris 11.3 | Aug 21, 2017 | Mar 19, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 23, 2017 |
| Suse | — | Upgrade selinux-policyUpgrade pcre-toolsUpgrade libpcre1-32bitUpgrade libpcre2-posix2Upgrade libpcrecpp0Upgrade libpcre2-16-0Upgrade libpcreposix0Upgrade selinux-policy-minimumUpgrade libpcre1Upgrade libpcre16-0Upgrade pcre-develUpgrade selinux-policy-develUpgrade pcre2-develUpgrade pcre-devel-staticUpgrade libpcre2-8-0Upgrade libpcrecpp0-32bitUpgrade libpcre2-32-0 | May 20, 2018 | Mar 19, 2017 |
| Ubuntu | — | Upgrade libpcre3 (Ubuntu Pro) | Oct 11, 2022 | Mar 19, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub