CVE-2015-2305

What it actually does

Integer overflow during regex compilation in the Henry Spencer BSD regex library on 32-bit platforms leads to a heap-based buffer overflow that can be leveraged for arbitrary code execution.

Why it matters to the business

Systems using vulnerable versions of affected packages remain exposed to remote code execution; the age of the issue combined with available exploits and downstream package prevalence increases the urgency of patching to prevent full system compromise.

How an attack unfolds

An attacker supplies a specially crafted large regular expression to an application that invokes the vulnerable regcomp function; the integer overflow during compilation results in an undersized heap allocation followed by a buffer overflow that overwrites memory and executes attacker-controlled code.

How to fix it

Upgrade affected packages to the fixed versions: consul-1.17-fips, consul-1.17-fips-oci-entrypoint, and consul-1.17-fips-oci-entrypoint-compat to 1.17.4-r9 or later; rebuild any downstream images that embed the vulnerable library and redeploy.

How to confirm the fix worked

Verify package versions match or exceed the listed fixed releases; recompile test binaries against the updated library and confirm the integer-overflow path no longer produces an undersized allocation; monitor build pipelines for continued use of the alpha3.8.g5 regex sources.

Typical attack path

1. Identify a network-accessible service or application that processes untrusted regular expressions using the vulnerable regex library
2. Craft a large regex pattern that triggers the integer overflow in regcomp on 32-bit systems
3. Send the malicious regex to the target, causing heap corruption and code execution
4. Establish persistence or perform follow-on actions such as data exfiltration or lateral movement

How to detect it

Review application logs for unusually large or malformed regular-expression inputs around the time of suspected compromise; inspect process memory dumps or core files for signs of heap corruption following regex compilation calls; correlate any unexpected code execution or crashes in services that handle user-supplied regex patterns.

What your security team should do

• Immediately upgrade all listed Consul Chainguard packages to the stated fixed versions
• Scan container registries and build artifacts for any remaining instances of the vulnerable regex library
• Prioritize patching of 32-bit deployments first due to the platform-specific overflow condition
• Add dependency-version checks to CI pipelines to prevent reintroduction of the vulnerable library