CVE catalog

CVE-2017-16231

pcre3: CVE-2017-16231

Severity: Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Nov 1, 2017, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.54% · Oct 25, 2026

In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pcre3	bookworm	`2:8.39-15`	vulnerable
Alpine	pcre	3.10	`7.8-r0`	fixed
Alpine	pcre	3.11	`7.8-r0`	fixed
Alpine	pcre	3.12	`7.8-r0`	fixed
Alpine	pcre	3.13	`7.8-r0`	fixed
Alpine	pcre	3.14	`7.8-r0`	fixed
Alpine	pcre	3.15	`7.8-r0`	fixed
Alpine	pcre	3.16	`7.8-r0`	fixed
Alpine	pcre	3.17	`7.8-r0`	fixed
Alpine	pcre	3.18	`7.8-r0`	fixed
Alpine	pcre	3.19	`7.8-r0`	fixed
Alpine	pcre	3.20	`7.8-r0`	fixed
Alpine	pcre	3.21	`7.8-r0`	fixed
Alpine	pcre	3.22	`7.8-r0`	fixed
Alpine	pcre	3.23	`7.8-r0`	fixed
Alpine	pcre	3.24	`7.8-r0`	fixed
Alpine	pcre	3.3	`7.8-r0`	fixed
Alpine	pcre	3.4	`7.8-r0`	fixed
Alpine	pcre	3.5	`7.8-r0`	fixed
Alpine	pcre	3.6	`7.8-r0`	fixed
Alpine	pcre	3.7	`7.8-r0`	fixed
Alpine	pcre	3.8	`7.8-r0`	fixed
Alpine	pcre	3.9	`7.8-r0`	fixed
Alpine	tiff	3.10	`4.0.9-r0`	fixed
Alpine	tiff	3.11	`4.0.9-r0`	fixed
Alpine	tiff	3.12	`4.0.9-r0`	fixed
Alpine	tiff	3.13	`4.0.9-r0`	fixed
Alpine	tiff	3.14	`4.0.9-r0`	fixed
Alpine	tiff	3.15	`4.0.9-r0`	fixed
Alpine	tiff	3.16	`4.0.9-r0`	fixed
Alpine	tiff	3.17	`4.0.9-r0`	fixed
Alpine	tiff	3.18	`4.0.9-r0`	fixed
Alpine	tiff	3.19	`4.0.9-r0`	fixed
Alpine	tiff	3.20	`4.0.9-r0`	fixed
Alpine	tiff	3.21	`4.0.9-r0`	fixed
Alpine	tiff	3.22	`4.0.9-r0`	fixed
Alpine	tiff	3.23	`4.0.9-r0`	fixed
Alpine	tiff	3.24	`4.0.9-r0`	fixed
Alpine	tiff	3.3	`4.0.9-r0`	fixed
Alpine	tiff	3.4	`4.0.9-r0`	fixed
Alpine	tiff	3.5	`4.0.9-r0`	fixed
Alpine	tiff	3.6	`4.0.9-r0`	fixed
Alpine	tiff	3.7	`4.0.9-r0`	fixed
Alpine	tiff	3.8	`4.0.9-r0`	fixed
Alpine	tiff	3.9	`4.0.9-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pcre3	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Alpine	pcre	apk	3.10	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.11	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.12	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.13	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.14	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.15	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.16	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.17	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.18	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.19	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.20	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.21	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.22	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.23	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.24	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.3	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.4	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.5	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.6	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.7	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.8	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	pcre	apk	3.9	`7.8-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.10	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.11	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.12	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.13	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.14	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.15	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.16	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.17	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.18	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.19	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.20	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.21	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.22	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.23	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.24	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.3	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.4	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.5	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.6	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.7	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.8	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported
Alpine	tiff	apk	3.9	`4.0.9-r0`	Not reported	ALPINE-CVE-2017-16231	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libpcre16-3]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
[libpcre3]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
[libpcre32-3]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
[libpcre3-dbg]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
[libpcre3-dev]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
[libpcrecpp0v5]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
[pcregrep]Unknown
Source package: [pcre3]
Details (2)
- 2:8.39-15 · amd64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12
- 2:8.39-15 · arm64 · bookworm
  Affected
  dsa · pcre3 · debian · bookworm; dsa · pcre3 · debian · 12

Observed: Oct 23, 2026, 5:27:23 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]