Critical Security Flaw in pcre2 Package: Out-of-Bounds Vulnerabilities and Arbitrary Code Execution
Summary
RLSA-2026:81522: Important: pcre2 security update. Affects pcre2 versions < 0:10.44-1.5.el10_2. Fixed in 0:10.44-1.5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The pcre2 package is a modern implementation of the Perl Compatible Regular Expressions library, widely used for pattern matching in various programming languages and applications. It offers advanced features such as Just-In-Time (JIT) compilation for improved performance. However, recent vulnerabilities have been identified that could allow attackers to exploit the library, leading to severe security risks.
Vulnerability Detail
The vulnerabilities in the pcre2 package stem from multiple out-of-bounds read and write issues, which can be triggered by crafted regular expressions. These flaws can lead to arbitrary code execution, denial of service, and memory corruption. Specifically, the vulnerabilities include out-of-bounds writes that allow attackers to execute arbitrary code, and out-of-bounds reads that can cause application crashes or unexpected behavior. The vulnerabilities are tracked under several CVEs, including CVE-2026-86145 and CVE-2026-89156, among others.
How To Fix
Minimum fixed version
0:10.44-1.5.el10_2
This is the first release that contains the fix.
sudo dnf update pcre2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize regular expressions before processing them with pcre2. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The pcre2 package has critical vulnerabilities that could lead to severe security issues, including arbitrary code execution and denial of service. It is crucial to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pcre2 →
FAQ
The CVSS score of the vulnerability is 8.2, indicating a high severity level.
The potential impacts include arbitrary code execution, denial of service, and memory corruption, which can compromise the security and stability of applications using pcre2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update the package immediately, implement input validation to sanitize regular expressions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
