critical
CVE-2016-3191
pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12)
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Amazon (high), Oracle (high), Ubuntu (medium).
Description
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.4 | pcre | 8.38-r1 |
| amazon linux 1 | pcre, pcre-debuginfo, pcre-devel and 2 more | 8.21-7.8.amzn1 |
| debian 11 | pcre2, pcre3 | 10.21-1 and 1 more |
| debian 12 | pcre2, pcre3 | 10.21-1 and 1 more |
| debian 13 | pcre2 | 10.21-1 |
| debian 14 | pcre2 | 10.21-1 |
| debian 7 | pcre3 | no fix listed |
| debian 8 | pcre3 | 2:8.35-3.3+deb8u3 |
| echo | pcre2, pcre3 | 10.21-1 and 1 more |
| Oracle Linux 7 | pcre, pcre-devel, pcre-static and 1 more | 8.32-15.el7_2.1 |
| seal Red Hat 6 | pcre, seal-pcre | 7.8-7.el6+sp999 |
| ubuntu 14.04 | pcre3 | 1:8.31-2ubuntu2.2 |
Show all 25 entries from 14 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.4 | pcre | 8.38-r1 |
| amazon linux 1 | pcre | 8.21-7.8.amzn1 |
| amazon linux 1 | pcre-debuginfo | 8.21-7.8.amzn1 |
| amazon linux 1 | pcre-devel | 8.21-7.8.amzn1 |
| amazon linux 1 | pcre-static | 8.21-7.8.amzn1 |
| amazon linux 1 | pcre-tools | 8.21-7.8.amzn1 |
| debian 11 | pcre2 | 10.21-1 |
| debian 11 | pcre3 | 2:8.38-2 |
| debian 12 | pcre2 | 10.21-1 |
| debian 12 | pcre3 | 2:8.38-2 |
| debian 13 | pcre2 | 10.21-1 |
| debian 14 | pcre2 | 10.21-1 |
| debian 7 | pcre3 | no fix listed |
| debian 8 | pcre3 | 2:8.35-3.3+deb8u3 |
| echo | pcre2 | 10.21-1 |
| echo | pcre3 | 2:8.38-2 |
| Oracle Linux 7 | pcre | 8.32-15.el7_2.1 |
| Oracle Linux 7 | pcre-devel | 8.32-15.el7_2.1 |
| Oracle Linux 7 | pcre-static | 8.32-15.el7_2.1 |
| Oracle Linux 7 | pcre-tools | 8.32-15.el7_2.1 |
| seal Red Hat 6 | pcre | 7.8-7.el6+sp999 |
| seal Red Hat 6 | seal-pcre | 7.8-7.el6+sp999 |
| ubuntu 14.04 | pcre3 | 1:8.31-2ubuntu2.2 |
| ubuntu 14.04-ESM | pcre3 | 1:8.31-2ubuntu2.2 |
| ubuntu 15.10 | pcre3 | 2:8.35-7.1ubuntu1.3 |
References
- http://rhn.redhat.com/errata/RHSA-2016-1025.html
- http://vcs.pcre.org/pcre2?view=revision&revision=489
- http://vcs.pcre.org/pcre?view=revision&revision=1631
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84810
- https://access.redhat.com/errata/RHSA-2016:1132
- https://access.redhat.com/security/cve/CVE-2016-3191
All 19 references
- https://bto.bluecoat.com/security-advisory/sa128
- https://bugs.debian.org/815920
- https://bugs.debian.org/815921
- https://bugs.exim.org/show_bug.cgi?id=1791
- https://bugzilla.redhat.com/show_bug.cgi?id=1311503
- https://linux.oracle.com/cve/CVE-2016-3191.html
- https://linux.oracle.com/errata/ELSA-2016-1025.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-3191
- https://ubuntu.com/security/notices/USN-2943-1
- https://www.cve.org/CVERecord?id=CVE-2016-3191
- https://www.tenable.com/security/tns-2016-18