CVE-2015-8386

Critical

Published: 02/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

Risk Assessment

Organizations may be exposed to attacks leading to denial of service, affecting the availability of their services. Additionally, there is a risk of unspecified impact on systems, potentially leading to further security issues.

Recommendation

It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability. Monitoring the use of regular expressions in applications is also advised to minimize the risk of attacks.

Original NVD description (English source)

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.