Denial of Service Vulnerability in PCRE Library by Study of Regular Expressions

CVE-2015-2325

What is CVE-2015-2325?

The PCRE Library, prior to version 8.37, is susceptible to a vulnerability that allows attackers to create unsafe regular expressions. This involves crafting expressions with a forward reference repeated extensively within a larger, repeatedly defined outer group that has a zero minimum quantifier. Such crafted expressions can lead to out-of-bounds heap reads, causing the library to crash and potentially resulting in a denial of service. The exploit poses a threat not merely limited to immediate service disruption but opens pathways to further undefined impacts.

References