Pcre Pcre

Do you want an email whenever new security vulnerabilities are reported in Pcre?

By the Year

In 2022 there have been 0 vulnerabilities in Pcre . Pcre did not have any published security vulnerabilities last year.

Year Vulnerabilities Average Score
2022 0 0.00
2021 0 0.00
2020 2 6.40
2019 0 0.00
2018 0 0.00

It may take a day or so for new Pcre vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Pcre Security Vulnerabilities

libpcre in PCRE before 8.44

CVE-2020-14155 5.3 - Medium - June 15, 2020

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

Integer Overflow or Wraparound

libpcre in PCRE before 8.43

CVE-2019-20838 7.5 - High - June 15, 2020

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

Out-of-bounds Read

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c

CVE-2017-11164 7.5 - High - July 11, 2017

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Stack Exhaustion

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g

CVE-2017-6004 7.5 - High - February 16, 2017

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.

Out-of-bounds Read

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which

CVE-2016-1283 9.8 - Critical - January 03, 2016

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Buffer Overflow

Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP

CVE-2005-2491 - August 23, 2005

Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Pcre or by Pcre? Click the Watch button to subscribe.

Pcre
Vendor

Pcre
Product

subscribe