Pcre

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Pcre product.

RSS Feeds for Pcre security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Pcre products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Pcre Sorted by Most Security Vulnerabilities since 2018

Pcre16 vulnerabilities

Pcre Perl Compatible Regular Expression Library7 vulnerabilities

Pcre25 vulnerabilities

By the Year

In 2026 there have been 0 vulnerabilities in Pcre. Pcre did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	0	0.00
2023	1	7.50
2022	2	9.10
2021	0	0.00
2020	5	6.20
2019	1	5.50

It may take a day or so for new Pcre vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Pcre Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2022-41409	Jul 18, 2023	PCRE2: Integer Overflow in pcre2test (pre10.41) -> DoS Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.	Pcre2
CVE-2022-1587	May 16, 2022	An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.	Pcre2
CVE-2022-1586	May 16, 2022	An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.	Pcre2
CVE-2020-14155	Jun 15, 2020	libpcre in PCRE before 8.44 libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.	Pcre
CVE-2019-20838	Jun 15, 2020	libpcre in PCRE before 8.43 libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.	Pcre
CVE-2019-20454	Feb 14, 2020	An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.	Pcre2
CVE-2015-2325	Jan 14, 2020	The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.	Pcre
CVE-2015-2326	Jan 14, 2020	The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".	Pcre
CVE-2017-16231	Mar 21, 2019	In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used	Pcre
CVE-2017-11164	Jul 11, 2017	In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.	Pcre