CVE-2007-6067
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as...
6.8 Medium
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
Exploit likelihood
3.85%Up 1.3 points since Feb 4, 2022
What each source reports
NVD Score used
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
- Record
CVE-2007-6067- CVSS 2.0
- 6.8 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
- Record
CVE-2007-6067- Updated
- 2026-11-02
EUVDEUVD-2007-6037 No score
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
- Record
EUVD-2007-6037- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r822-pwxw-5qc9 No score
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as...
Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
- Record
GHSA-r822-pwxw-5qc9- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postgresql-8.1Debian:4.0 From an advisory covering 6 CVEs |
before 8.1.11-0etch1, plus listed versions 8.1.10-0etch18.1.10-18.1.8-18.1.8-28.1.9-0etch18.1.9-0etch28.1.9-1 |
8.1.11-0etch1 |
postgresql-7.4Debian:4.0 From an advisory covering 6 CVEs |
before 7.4.19-0etch1 | 7.4.19-0etch1 |
postgresqlDebian:3.1 From an advisory covering 6 CVEs |
before 7.4.7-6sarge6, plus listed versions 7.4.7-6sarge17.4.7-6sarge27.4.7-6sarge37.4.7-6sarge47.4.7-6sarge5 |
7.4.7-6sarge6 |
postgresqlRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-contribRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-develRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-docsRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-jdbcRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-libsRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
Show 86 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postgresql-plRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-pythonRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-serverRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-tclRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-testRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresqlRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-contribRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-develRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-docsRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-jdbcRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-libsRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-plRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-pythonRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-serverRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-tclRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-testRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresqlRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-contribRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-develRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-docsRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-jdbcRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-libsRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-plRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-pythonRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-serverRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-tclRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-testRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresqlRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-contribRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-develRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-docsRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-jdbcRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-libsRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-plRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-pythonRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-serverRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-tclRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresql-testRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
postgresqlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-plRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-testRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresqlRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-contribRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-docsRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-libsRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-pythonRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-tclRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresqlRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-contribRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-docsRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-libsRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-plRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-pythonRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-serverRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-tclRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresql-testRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
postgresqlRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-contribRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-debuginfoRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-develRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-docsRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-libsRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-plRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-pythonRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-serverRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-tclRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
postgresql-testRed Hat:rhel_application_stack:1 From an advisory covering 6 CVEs |
before 0:8.1.11-1.el4s1.1 | 0:8.1.11-1.el4s1.1 |
tclRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tclRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-htmlRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tclRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
tcl-htmlRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:8.4.13-6.el5 | 0:8.4.13-6.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6067 is a medium vulnerability (CVSS 6.8) in Postgresql, published January 9, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.85%, the 90th percentile. No source names a fixed version.
References
mandriva.com/security/advisories?name=MDVSA-2008:004
debian.org/security/2008/dsa-1460
rhn.redhat.com/errata/RHSA-2013-0122.html
securityfocus.com/bid/27163
issues.rpath.com/browse/RPL-1768
redhat.com/support/errata/RHSA-2008-0038.html
Show 67 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/39498
secunia.com/advisories/28454
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10235
postgresql.org/about/news.905
lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
vupen.com/english/advisories/2008/0061
sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894
sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154
usn.ubuntu.com/568-1
securitytracker.com/id?1019157
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
security.gentoo.org/glsa/glsa-200801-15.xml
nvd.nist.gov/vuln/detail/CVE-2007-6067
github.com/advisories/GHSA-r822-pwxw-5qc9
access.redhat.com/errata/RHSA-2008:0038
bugzilla.redhat.com/show_bug.cgi?id=309141
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0038.json
cve.org/CVERecord?id=CVE-2007-3278