CVE-2005-4872

PCRE < 6.1 - Denial of Service via Large Number of Named Subpatterns

Title source: llm
STIX 2.1

Description

Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allows context-dependent attackers to cause a denial of service (crash) via a regular expression with a large number of named subpatterns, which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.

References (13)

Core 13
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:030
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28658
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27773
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/26462
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-1052.html
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_62_pcre.html
Various Sources x_refsource_confirm
http://www.pcre.org/changelog.txt
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27869
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11615
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27582
Various Sources x_refsource_misc
http://scary.beasts.org/security/CESA-2007-006.html

Scores

EPSS 0.0232
EPSS Percentile 81.5%

Details

CWE
CWE-119
Status published
Products (1)
pcre/pcre < 6.1
Published Dec 31, 2005
Tracked Since Feb 18, 2026