Red Hat Security AdvisoryRHSA-2026:82875
pcre2 security update
Released 2026-10-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) pcre2-devel-10.40-5.el9_4.1, pcre2-utf16-10.40-5.el9_4.1, pcre2-utf32-10.40-5.el9_4.1
- Red Hat Enterprise Linux BaseOS E4S (v.9.4) pcre2-10.40-5.el9_4.1, pcre2-syntax-10.40-5.el9_4.1
Fixes 3 records
Priority HIGH 66
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2026-09-30 · Partial fix · 10.49 CWE-787
Priority MEDIUM 42
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purp…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-09-05 · Partial fix · 10.48 CWE-424
Priority LOW 35
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00126 · Published 2026-09-11 · Partial fix · 10.48 CWE-590
THREATIST.IORead the docs