CVE-2017-6004

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.

• CWE-125

• http://www.securityfocus.com/bid/96295
• http://www.securitytracker.com/id/1037850
• https://access.redhat.com/errata/RHSA-2018:2486
• https://bugs.exim.org/show_bug.cgi?id=2035Issue Tracking, Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/201706-11
• https://vcs.pcre.org/pcre/code/trunk/pcre_jit_compile.c?r1=1676&r2=1680&view=patchPatch
• http://www.securityfocus.com/bid/96295
• http://www.securitytracker.com/id/1037850
• https://access.redhat.com/errata/RHSA-2018:2486
• https://bugs.exim.org/show_bug.cgi?id=2035Issue Tracking, Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/201706-11
• https://vcs.pcre.org/pcre/code/trunk/pcre_jit_compile.c?r1=1676&r2=1680&view=patchPatch

Published

Feb 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5998Cross-site scripting (XSS) vulnerability in InterSect Allian…
• CVE-2017-5999An issue was discovered in sysPass 2.x before 2.1, in which …
• CVE-2017-6000Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-6001Race condition in kernel/events/core.c in the Linux kernel b…7
• CVE-2017-6002Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attack…
• CVE-2017-6003dotCMS 3.7.0 has XSS reachable from ext/languages_manager/ed…
• CVE-2017-6005Waves MaxxAudio, as installed on Dell laptops, adds a "Waves…
• CVE-2017-6006Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-6007A kernel pool overflow in the driver hitmanpro37.sys in Soph…
• CVE-2017-6008A kernel pool overflow in the driver hitmanpro37.sys in Soph…
• CVE-2017-6009An issue was discovered in icoutils 0.31.1. A buffer overflo…
• CVE-2017-6010An issue was discovered in icoutils 0.31.1. A buffer overflo…