Sign inStart freeBook a demo

Pcre vulnerabilitiesNone on the known-exploited list.

Vendor
The short answer

Pcre has 58 published vulnerabilities across 5 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Pcre, with 34. If you run Pcre software, patch the exploited flaws first.

See the exploited flaws

We keep watching the known-exploited list.

Products

Which Pcre products have the most vulnerabilities?

Pcre leads with 34 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.

  1. Pcre34
  2. Perl Compatible Regular Expression Library16
  3. Pcre211
  4. Perl-Compatible Regular Expression Library1
  5. Libpcre0
Published vulnerabilities
Known exploited

Which Pcre vulnerabilities are being exploited?

This is the list that matters most: flaws criminals are using now.

None of Pcre's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.

Exploit likelihood

Which Pcre flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. 9.2%
    CVE-2015-3210Critical

    Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by...

    CVSS9.8Published13 Dec 2016
  2. 8.4%
    CVE-2016-3191Critical

    The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which...

    CVSS9.8Published17 Mar 2016
  3. 7.8%
    CVE-2016-1283Critical

    The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and...

    CVSS9.8Published3 Jan 2016
  4. 7.7%
    CVE-2015-5073Critical

    Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and...

    CVSS9.1Published13 Dec 2016
  5. 6.9%
    CVE-2015-8386Critical

    PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other...

    CVSS9.8Published2 Dec 2015
  6. 6.7%
    CVE-2008-2371High

    Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via...

    CVSS7.5Published7 Jul 2008
  7. 6.6%
    CVE-2015-8388High

    PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly...

    CVSS7.5Published2 Dec 2015
  8. 6.5%
    CVE-2014-8964Medium

    Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows...

    CVSS5.0Published16 Dec 2014
  9. 6.4%
    CVE-2015-8391Critical

    The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact...

    CVSS9.8Published2 Dec 2015
  10. 6.2%
    CVE-2015-3217High

    PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as...

    CVSS7.5Published13 Dec 2016
Every product

All Pcre products we track.

5 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.

Precursor Intelligence

Running Pcre? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

Our catalogue lists 58 published vulnerabilities across 5 products and 117 versions from Pcre.

None of Pcre's vulnerabilities is on the list of flaws known to be exploited today.

Pcre, with 34 published vulnerabilities. Its own page lists the ones known to be exploited.

Create a Precursor Intelligence account and track the Pcre products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

Keep exploring