CVE-2015-8394: Pcre Perl Compatible Regular Expression Library

Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days.

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Affected products

• Pcre Perl Compatible Regular Expression Library: up to and including 8.37
• PHP PHP: from 5.5.0, before 5.5.32 (fixed in 5.5.32); from 5.6.0, before 5.6.18 (fixed in 5.6.18); from 7.0.0, before 7.0.3 (fixed in 7.0.3)

Published 2015-12-02. Last modified 2026-06-17.