Pcre: community verdicts
6 notable / known-exploited Pcre CVEs the community has triaged.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2017 | 3 | 0 |
| 2018 | 0 | 0 |
| 2019 | 1 | 0 |
| 2020 | 1 | 0 |
| 2021 | 0 | 0 |
| 2022 | 0 | 0 |
| 2023 | 1 | 0 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2017-7246HIGH 7.8Real · low riskEPSS 3%
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.
- CVE-2017-7245HIGH 7.8Real · low riskEPSS 2%
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.
- CVE-2017-11164HIGH 7.5Real · low riskEPSS 3%
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
- CVE-2022-41409HIGH 7.5Real · low riskEPSS 1%
Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
- CVE-2019-20838HIGH 7.5Real · low riskEPSS 3%
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
- CVE-2017-16231MED 5.5EPSS 1%
In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used