Description
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
Remediation
References
Related Vulnerabilities
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-8625)
WordPress 4.7.x Cross-Domain Flash Injection Vulnerability (4.7 - 4.7.8)
WebLogic Improper Access Control Vulnerability (CVE-2026-35263)
PostgreSQL Arbitrary Code Execution Vulnerbality (CVE-2020-25696)