Red Hat Security AdvisoryRHSA-2026:81613
pcre2 security update
Released 2026-10-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 8) pcre2-10.32-4.el8_10, pcre2-devel-10.32-4.el8_10, pcre2-utf16-10.32-4.el8_10 +1
- Red Hat Enterprise Linux CRB (v. 8) pcre2-tools-10.32-4.el8_10
Fixes 4 records
Priority HIGH 66
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2026-09-30 · Partial fix · 10.49 CWE-787
Priority HIGH 66
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00348 · Published 2026-09-11 · Partial fix · 10.48 CWE-190
Priority MEDIUM 42
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purp…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-09-05 · Partial fix · 10.48 CWE-424
Priority LOW 28
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00247 · Published 2026-09-11 · Partial fix · 10.48 CWE-190
THREATIST.IORead the docs