CVE-2016-9643

The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis).

• CWE-400

• http://www.openwall.com/lists/oss-security/2016/11/26/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/11/26/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94559
• http://www.securitytracker.com/id/1038137
• https://security.gentoo.org/glsa/201706-15
• http://www.openwall.com/lists/oss-security/2016/11/26/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/11/26/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94559
• http://www.securitytracker.com/id/1038137
• https://security.gentoo.org/glsa/201706-15

Published

Mar 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9635Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9636Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9637The (1) ioport_read and (2) ioport_write functions in Xen, w…
• CVE-2016-9638In BMC Patrol before 9.13.10.02, the binary "listguests64" i…
• CVE-2016-9639Salt before 2015.8.11 allows deleted minions to read or writ…
• CVE-2016-9642JavaScriptCore in WebKit allows attackers to cause a denial …
• CVE-2016-9644The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.…
• CVE-2016-9645The fix for ikiwiki for CVE-2016-10026 was incomplete result…
• CVE-2016-9646ikiwiki before 3.20161229 incorrectly called the CGI::FormBu…
• CVE-2016-9647Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9648Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9649Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…