CVE-2017-6004

—

CVSS 3.0

7.5 high

EPSS

5%p91

Published

Feb 16, 2017 (Feb 16, 2017)

Modified

Jun 17, 2026

Description

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.

Vendors: pcre
Products: pcre
Weakness: CWE-125
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (4.5%)

In the news0 stories

No ingested article mentions this CVE yet.