CVE-2007-6067: Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in Post...

Security readout for executives and security teams

This is an old denial-of-service issue in Tcl's regular expression parser, exposed through affected PostgreSQL releases. An authenticated database user could submit a specially complex regular expression that causes excessive memory use and may disrupt database availability. The supplied data does not show CISA KEV listing or active exploitation. Exposure is most likely in legacy PostgreSQL deployments or packaged appliances still running the listed 7.4, 8.0, 8.1, or 8.2 branches. Systems where untrusted or low-privilege users can run database regular expression queries have higher practical risk. Treat this as a legacy availability risk, not a modern internet-scale emergency based on the supplied evidence. Prioritize remediation where old PostgreSQL instances support business-critical systems or permit broad authenticated query access. Mitigation focus: Upgrade PostgreSQL to the fixed branch release or later.; Upgrade standalone Tcl deployments to 8.4.17 or later.; Restrict database access for untrusted users where upgrades are pending..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.