CVE-2005-4872: Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named ca...

Security readout for executives and security teams

This is an old PCRE library flaw where specially crafted regular expressions can crash software using vulnerable PCRE versions before 6.2. The business risk is service interruption, not confirmed data theft or code execution. Exposure depends on whether any deployed product still embeds or links to that legacy PCRE code. Most modern systems should not be exposed unless they run legacy distributions, appliances, or applications bundling PCRE before 6.2. Vendor advisories indicate downstream impact existed across some Linux and appliance ecosystems, but the bundle does not identify specific current affected products. Treat this as a legacy availability risk. Prioritize it in environments with old appliances, unsupported servers, or applications that process user-supplied regular expressions. It is not KEV-listed and the supplied sources do not show active exploitation. Mitigation focus: Identify systems and applications using PCRE before 6.2.; Check vendor advisories for supported update packages or appliance guidance.; Upgrade PCRE or vendor packages where fixes are available..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.