Critical Vulnerability in PCRE2 Package: Out-of-Bounds Write Leading to Code Execution
Summary
RLSA-2026:81613: Important: pcre2 security update. Affects pcre2 versions < 0:10.32-4.el8_10. Fixed in 0:10.32-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcre2 package is a modern implementation of the Perl Compatible Regular Expressions library, which is widely used for pattern matching in various programming environments. It allows developers to utilize regular expressions with the same syntax and semantics as Perl, making it a powerful tool for text processing. However, recent security findings have revealed critical vulnerabilities that could allow attackers to exploit the library through crafted regular expressions.
Vulnerability Detail
The vulnerabilities in the pcre2 package stem from out-of-bounds write issues that can be triggered by specially crafted regular expressions. These vulnerabilities include an out-of-bounds write that allows arbitrary code execution (CVE-2026-86145), an out-of-bounds write via large pattern input (CVE-2026-89157), and an out-of-bounds write due to integer overflow on 32-bit platforms (CVE-2026-89158). Additionally, another out-of-bounds write can occur through crafted regular expressions (CVE-2026-103111). The ramifications of these vulnerabilities are severe, as they can lead to unauthorized code execution, potentially compromising the integrity and security of affected systems.
How To Fix
Minimum fixed version
0:10.32-4.el8_10
This is the first release that contains the fix.
sudo dnf update pcre2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize regular expressions before processing them. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The pcre2 package has critical vulnerabilities that can lead to severe security risks, including arbitrary code execution. It is crucial to update to the latest patched version to protect your systems. Additionally, utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications.
See every vulnerability recorded for pcre2 →
FAQ
The CVSS score of the vulnerabilities in the pcre2 package is 8.2, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The vulnerabilities can lead to arbitrary code execution, which may allow attackers to gain unauthorized access to systems, manipulate data, or disrupt services.
Yes, the patched version of pcre2 is 0:10.32-4.el8_10. Updating to this version will mitigate the vulnerabilities.
If you cannot update the package right away, implement input validation to sanitize regular expressions to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
