TI-2015-06914 Aliases CVE-2015-8394 GHSA-wpvc-3mh7-8pwj

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows…

MEDIUM 50CWE-190Published 2015-12-02 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Why it matters now

EPSS 0.04815 92nd percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:pcre:perl_compatible_regular_expression_library::::::::	up to 8.37	Vulnerable	PCRE
cpe:2.3:a:php:php::::::::	5.5.0 to before 5.5.32; 5.6.0 to before 5.6.18; 7.0.0 to before 7.0.3	Vulnerable	PHP

cpe:2.3:a:pcre:perl_compatible_regular_expression_library:*:*:*:*:*:*:*:* Versions up to 8.37 Vulnerable ·PCRE
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 5.5.0 to before 5.5.32; 5.6.0 to before 5.6.18; 7.0.0 to before 7.0.3 Vulnerable ·PHP

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Directory Server 8	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 1	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 2	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 3	Affected	No fix planned: Will not fix
Red Hat Software Collections	Affected	No fix planned: Will not fix

Not affected: 1 product

Red Hat Software Collections

Timeline

2026-10-02 Threatist record created from CVE-2015-8394
2026-10-03 Alias added: GHSA-wpvc-3mh7-8pwj

References

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences