Aggregates CVE and security vulnerability intelligence across all PCRE-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk buffer overflow, vendor risk memory corruption, and vendor risk path handling, with potential vendor impact application crash across vendor surface production workloads use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-58050 | The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable | [email protected] | 6.9 | 0.67% | 2025-08-27 | 2026-06-17 |
| CVE-2022-41409 | Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. | [email protected] | 7.5 | 1.12% | 2023-07-18 | 2026-06-17 |
| CVE-2022-1587 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. | [email protected] | 9.1 | 2.57% | 2022-05-16 | 2026-06-17 |
| CVE-2022-1586 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. | [email protected] | 9.1 | 3.19% | 2022-05-16 | 2026-06-17 |
| CVE-2020-14155 | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. | [email protected] | 5.3 | 4.18% | 2020-06-15 | 2026-06-16 |
| CVE-2019-20838 | libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. | [email protected] | 7.5 | 2.77% | 2020-06-15 | 2026-06-16 |
| CVE-2019-20454 | An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. | [email protected] | 7.5 | 1.56% | 2020-02-14 | 2026-06-16 |
| CVE-2015-2326 | The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/". | [email protected] | 5.5 | 1.59% | 2020-01-14 | 2026-06-16 |
| CVE-2015-2325 | The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier. | [email protected] | 7.8 | 1.57% | 2020-01-14 | 2026-06-16 |
| CVE-2017-16231 | In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used | [email protected] | 5.5 | 0.52% | 2019-03-21 | 2026-06-16 |
| CVE-2017-11164 | In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression. | [email protected] | 7.5 | 3.10% | 2017-07-10 | 2026-06-16 |
| CVE-2017-8786 | pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. | [email protected] | 9.8 | 4.07% | 2017-05-04 | 2026-06-16 |
| CVE-2017-8399 | PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures." | [email protected] | 9.8 | 3.12% | 2017-05-01 | 2026-06-16 |
| CVE-2017-7246 | Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. | [email protected] | 7.8 | 2.60% | 2017-03-23 | 2026-06-16 |
| CVE-2017-7245 | Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. | [email protected] | 7.8 | 2.22% | 2017-03-23 | 2026-06-16 |
| CVE-2017-7244 | The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file. | [email protected] | 5.5 | 1.99% | 2017-03-23 | 2026-06-16 |
| CVE-2017-7186 | libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. | [email protected] | 7.5 | 5.03% | 2017-03-19 | 2026-06-16 |
| CVE-2017-6004 | The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression. | [email protected] | 7.5 | 4.55% | 2017-02-16 | 2026-06-16 |
| CVE-2015-5073 | Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. | [email protected] | 9.1 | 7.67% | 2016-12-13 | 2026-06-16 |
| CVE-2015-3217 | PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. | [email protected] | 7.5 | 6.17% | 2016-12-13 | 2026-06-16 |