re2c vulnerabilities

Products

• re2c 4

Latest re2c CVEs

Newest publication first

1. CVE-2026-2903 skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference

   Published 2026-02-22

   Medium·CVSS 4.8 EPSS 0.13%

   A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch...

2. CVE-2022-23901 A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.

   Published 2022-03-29

   Critical·CVSS 9.8 EPSS 1.6%

   A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.

3. CVE-2018-21232 re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

   Published 2020-04-29

   Medium·CVSS 5.5 EPSS 1.5%

   re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

4. CVE-2020-11958 re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.

   Published 2020-04-21

   High·CVSS 7.8 EPSS 1.7%

   re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.