The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-pcre3 | Jul 30, 2024 | Jan 14, 2020 | |
| Mariadb Mariadb | mariadb-mariadb-upgrade-latest | Mar 4, 2025 | Jan 14, 2020 | |
| Oracle Solaris | oracle-solaris-11-2-upgrade-library-pcre-8-37-0-175-2-13-0-3-0 | May 29, 2017 | May 29, 2017 | |
| Php | php-upgrade-5_4_41php-upgrade-5_5_26php-upgrade-5_6_9 | Sep 15, 2022 | Jan 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub