Red Hat Security AdvisoryRHSA-2026:81532
pcre2 security update
Released 2026-10-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) pcre2-devel-10.40-7.el9_8, pcre2-utf16-10.40-7.el9_8, pcre2-utf32-10.40-7.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) pcre2-10.40-7.el9_8, pcre2-syntax-10.40-7.el9_8
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) pcre2-tools-10.40-7.el9_8
Fixes 7 records
Priority HIGH 66
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2026-09-30 · Partial fix · 10.49 CWE-787
Priority HIGH 66
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00348 · Published 2026-09-11 · Partial fix · 10.48 CWE-190
Priority MEDIUM 62
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00268 · Published 2026-09-11 · Partial fix · 10.48 CWE-125
Priority MEDIUM 42
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purp…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-09-05 · Partial fix · 10.48 CWE-424
Priority LOW 35
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00126 · Published 2026-09-11 · Partial fix · 10.48 CWE-590
Priority LOW 28
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00247 · Published 2026-09-11 · Partial fix · 10.48 CWE-190
Priority LOW 26
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00294 · Published 2026-09-11 · Partial fix · 10.48 CWE-125
THREATIST.IORead the docs