PCRE is a widely embedded regular-expression matching library that, despite a very narrow product portfolio, sits deep in the software supply chain and powers pattern matching across an enormous range of servers, applications, and utilities. Its vulnerabilities matter out of proportion to their count because a single flaw in the parser can propagate to every downstream product that links the library, and the vendor's disclosures skew strongly toward critical-severity outcomes. The recurring weakness classes, including buffer-boundary violations, out-of-bounds reads and writes, and integer overflow, reflect the memory-safety and parsing complexity inherent to a high-performance regex engine implemented in native code. Defenders should inventory products and libraries that bundle PCRE or PCRE2 rather than tracking the library alone, since remediation typically depends on downstream vendors rebuilding and redeploying; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pcre over time
Signals from CVEs in this vendor scope (58 CVEs).
58 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-3191CRITICAL The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction | Mar 17, 2016 | 9.8 | 35 | NO | NO |
CVE-2015-8390CRITICAL PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have u | Dec 2, 2015 | 9.8 | 33 | NO | NO |
CVE-2015-8389CRITICAL PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspe | Dec 2, 2015 | 9.8 | 32 | NO | NO |
CVE-2025-58050CRITICAL The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regula | Aug 27, 2025 | 9.1 | 31 | NO | NO |
CVE-2017-8786CRITICAL pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular express | May 5, 2017 | 9.8 | 31 | NO | NO |
CVE-2017-8399CRITICAL PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures." | May 1, 2017 | 9.8 | 31 | NO | NO |
CVE-2015-5073CRITICAL Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive i | Dec 13, 2016 | 9.1 | 31 | NO | NO |
CVE-2015-8386CRITICAL PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow | Dec 2, 2015 | 9.8 | 30 | NO | NO |
CVE-2022-1587CRITICAL An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in | May 16, 2022 | 9.1 | 29 | NO | NO |
CVE-2022-1586CRITICAL An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode prope | May 16, 2022 | 9.1 | 29 | NO | NO |
Signals from CVEs in this vendor scope (58 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pcre.
Media articles that mention a CVE ID that affects a product developed by Pcre — matched by CVE ID, not by vendor name.