CVE-2015-2326: MariaDB

Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days.

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

Affected products

• MariaDB MariaDB: from 10.0.0, before 10.0.18 (fixed in 10.0.18)
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Pcre Pcre: before 8.37 (fixed in 8.37)
• PHP PHP: from 5.4.0, before 5.4.41 (fixed in 5.4.41); from 5.5.0, before 5.5.26 (fixed in 5.5.26); from 5.6.0, before 5.6.9 (fixed in 5.6.9)

Published 2020-01-14. Last modified 2026-06-17.