Denial of Service Vulnerability in PCRE Software by PCRE Research

CVE-2015-2326

What is CVE-2015-2326?

The pcre_compile2 function in PCRE versions prior to 8.37 is susceptible to a vulnerability that enables context-dependent attackers to craft specific regular expressions. This can lead to the compilation of erroneous code, ultimately resulting in a denial of service due to an out-of-bounds read. An example of a potentially dangerous expression includes one that combines a forward referencing subroutine call with a recursive back reference, such as '((?+1)(\1))'. Users are advised to upgrade to secure versions to mitigate the risk.

References