Critical Vulnerability in pcre2 Package: Out-of-Bounds Write and Denial of Service Risks
Summary
ALSA-2026:81532: Important: pcre2 security update. Affects pcre2 versions < 10.40-7.el9_8. Fixed in 10.40-7.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcre2 package is a modern implementation of the Perl Compatible Regular Expressions library, which is widely used for pattern matching in various programming languages and applications. It provides a powerful and flexible way to work with regular expressions, enabling developers to perform complex text processing tasks efficiently. However, recent security findings have revealed multiple vulnerabilities within the pcre2 package that could lead to severe consequences, including arbitrary code execution and denial of service attacks.
Vulnerability Detail
The vulnerabilities in the pcre2 package stem from improper handling of regular expressions, particularly in scenarios involving crafted input. Key issues include out-of-bounds writes that can allow attackers to execute arbitrary code, out-of-bounds reads that can lead to information leakage, and denial of service conditions caused by invalid UTF data processing. These vulnerabilities arise from flaws in the library's implementation, particularly during Just-In-Time (JIT) compilation and pattern matching, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
10.40-7.el9_8
This is the first release that contains the fix.
sudo dnf update pcre2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using potentially unsafe regular expressions or limit the input size to reduce the risk of triggering the vulnerabilities. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The vulnerabilities identified in the pcre2 package pose significant risks, including arbitrary code execution and denial of service. Users are strongly encouraged to update to the latest patched version to mitigate these threats. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software effectively.
See every vulnerability recorded for pcre2 →
FAQ
The vulnerabilities include out-of-bounds writes and reads, which can lead to arbitrary code execution and denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing input validation and limiting the size of regular expressions as a temporary workaround.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to execute arbitrary code or cause service disruptions.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, allowing you to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
