Critical Security Flaw in pcre2 Package: Out-of-Bounds Write Vulnerabilities
Summary
ALSA-2026:81613: Important: pcre2 security update. Affects pcre2 versions < 10.32-4.el8_10. Fixed in 10.32-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcre2 package is a modern implementation of the Perl Compatible Regular Expressions library, widely used for pattern matching in various programming environments. It supports complex regular expressions with Perl-like syntax and semantics, making it a powerful tool for developers. However, recent security assessments have revealed multiple vulnerabilities that could lead to severe security risks, including arbitrary code execution.
Vulnerability Detail
The vulnerabilities in the pcre2 package stem from out-of-bounds write issues that can be exploited through crafted regular expressions. Specifically, these vulnerabilities allow attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of the system. The identified CVEs include CVE-2026-86145, CVE-2026-89157, CVE-2026-89158, and CVE-2026-103111, each detailing different scenarios where the vulnerabilities can be triggered, such as through large pattern inputs or integer overflows on 32-bit platforms.
How To Fix
Minimum fixed version
10.32-4.el8_10
This is the first release that contains the fix.
sudo dnf update pcre2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using untrusted or user-supplied regular expressions until the package is updated. Implement input validation to ensure that regular expressions are safe before processing them.
Conclusion
The pcre2 package has critical vulnerabilities that can lead to severe security risks, including arbitrary code execution. It is crucial to update to the latest patched version to protect your systems. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to potential issues without requiring code access.
See every vulnerability recorded for pcre2 →
FAQ
The vulnerabilities are primarily out-of-bounds write issues that can lead to arbitrary code execution when processing crafted regular expressions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The associated CVEs are CVE-2026-103111, CVE-2026-86145, CVE-2026-89157, and CVE-2026-89158, each detailing specific exploitation scenarios.
Yes, a patch is available in version 10.32-4.el8_10 of the pcre2 package. It is recommended to update to this version.
If immediate updates are not feasible, avoid processing untrusted regular expressions and implement strict input validation as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
