CVE-2015-2325: MariaDB

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

Affected products

• MariaDB MariaDB: before 10.0.18 (fixed in 10.0.18)
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Pcre Pcre: before 8.37 (fixed in 8.37)
• PHP PHP: from 5.4.0, before 5.4.41 (fixed in 5.4.41); from 5.5.0, before 5.5.26 (fixed in 5.5.26); from 5.6.0, before 5.6.9 (fixed in 5.6.9)

Published 2020-01-14. Last modified 2026-06-17.