PCRE 7.8 and 8.32 up to and including 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote malicious users to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
pcre pcre2 10.10 |
||
pcre pcre 8.33 |
||
pcre pcre 8.34 |
||
pcre pcre 8.32 |
||
pcre pcre 8.37 |
||
pcre pcre 7.8 |
||
pcre pcre 8.35 |
||
pcre pcre 8.36 |
||
ibm powerkvm 3.1 |
||
ibm powerkvm 2.1 |
Vulmon