CVE-2015-8391

Critical

Published: 02/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The pcre_compile function in PCRE before 8.38 mishandles certain [: nesting, which can lead to denial of service (CPU consumption) or other unspecified impacts via a crafted regular expression.

Risk Assessment

Remote attackers may exploit this vulnerability to overload the system, potentially causing service outages.

Recommendation

It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability.

Original NVD description (English source)

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.