CVE-2008-0171 Denial of service in n/a

Medium 5.0 Published 17 Jan 2008 Updated 7 Aug 2024

Attackers can cause a denial of service via invalid regular expressions in the Boost regex library, affecting applications using this component.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-0171?

CVE-2008-0171 is a medium-severity denial of service vulnerability in n/a, published on 17 Jan 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression.

Weakness: CWE-20

Which versions are affected by CVE-2008-0171?

It affects 2 products.

Linux distribution packages (1)

boost-legacy-base SUSE:Linux Enterprise Module for Legacy 15 SP2 All versions 1.66.0-1.4.1

Products include Boost Boost, Boost Boost Regex Library.

How do I fix CVE-2008-0171?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2008-0171 being exploited?

There is no known exploitation of CVE-2008-0171 in the wild and no public exploit code.

Sources

Also known as GHSA-mc8j-3vrc-57vf, SUSE-RU-2021:1414-1.