Pcre vulnerabilities, page 4
65 vulnerabilities
Known vulnerabilities in Pcre products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
MediumCVE-2026-89156Alpine Linuxalpine · pcre2 +3 morealpine pcre2PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.EPSS0.29%MediumCVE-2026-89160Alpine Linuxalpine · pcre2 +3 morealpine pcre2PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.EPSS0.27%MediumCVE-2006-7227debian · pcre3 +1 moredebian pcre3Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.EPSS3.50%MediumCVE-2006-7230debian · pcre3 +1 moredebian pcre3Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.EPSS1.67%MediumCVE-2006-7228debian · pcre3 +1 moredebian pcre3Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min, (2) max, or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow, a different vulnerability than CVE-2006-7227. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.EPSS3.66%