CVE-2015-8389

Critical

Published: 02/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, allowing remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression.

Risk Assessment

Organizations may be exposed to attacks leading to denial of service, which can affect the availability of their systems and applications.

Recommendation

It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability.

Original NVD description (English source)

PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.