CVE-2015-2305: Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha...

Security readout for executives and security teams

CVE-2015-2305 is a memory corruption flaw in Henry Spencer’s BSD regex library on 32-bit platforms. A very large regular expression can trigger an integer overflow during compilation and lead to heap buffer overflow. Business risk depends on whether exposed software accepts attacker-controlled regex patterns and uses an affected bundled or system copy. Most likely exposure is legacy 32-bit Unix/Linux or embedded systems, or applications bundling Henry Spencer regex code. Internet exposure requires a reachable feature that compiles user-supplied regular expressions. Prioritize remediation where legacy 32-bit systems process user-supplied regex input, especially exposed services. For patched mainstream systems, urgency is lower but inventory should confirm no stale bundled library remains. Mitigation focus: Apply relevant vendor security updates for affected operating systems and products.; Inventory 32-bit systems and software bundling Henry Spencer BSD regex code.; Check Debian, Ubuntu, Red Hat, SUSE, Apple, PHP, ClamAV, and NetBSD guidance as applicable..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.