Critical Vulnerability in pcre2 Package: Out-of-Bounds Write and Denial of Service Risks
Summary
RLSA-2026:81532: Important: pcre2 security update. Affects pcre2 versions < 0:10.40-7.el9_8. Fixed in 0:10.40-7.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcre2 package is a modern implementation of the Perl Compatible Regular Expressions library, designed for efficient pattern matching in strings. It supports advanced features such as Just-In-Time (JIT) compilation for improved performance. However, recent security findings have revealed multiple vulnerabilities that could lead to severe consequences, including arbitrary code execution and denial of service.
Vulnerability Detail
The vulnerabilities in the pcre2 package stem from improper handling of regular expressions, leading to out-of-bounds writes and reads. Specifically, crafted regular expressions can exploit these flaws, resulting in arbitrary code execution (CVE-2026-86145) and denial of service (CVE-2026-89160). The vulnerabilities are particularly concerning on 32-bit platforms due to integer overflow issues (CVE-2026-89158). These flaws can be triggered by malicious input, making systems using pcre2 susceptible to attacks.
How To Fix
Minimum fixed version
0:10.40-7.el9_8
This is the first release that contains the fix.
sudo dnf update pcre2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting the input to the pcre2 library to prevent the use of crafted regular expressions. Implement input validation to ensure that only safe patterns are processed.
Conclusion
The pcre2 package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can mitigate the risks associated with these vulnerabilities. Regular monitoring and input validation are also recommended to enhance security.
See every vulnerability recorded for pcre2 →
FAQ
The CVSS score of the vulnerability is 8.2, indicating a high level of severity.
The vulnerability affects systems using the pcre2 package, particularly those running Rocky Linux 9.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, memory corruption, and denial of service, potentially compromising system integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
