CVE-2017-16231
pcre: self-recursive call in match() in pcre_exec.c leads to denial of service
Severity
UnknownRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 1, 2017
Updated · August 5, 2026
Description
In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used
Statement
Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-770 · Allocation of Resources Without Limits or Throttling