Critical UNKNOWN READ Vulnerability in mrab-regex Package
Summary
OSV-2026-1072: UNKNOWN READ in _regex.cpython-311-x86_64-linux-gnu.so. Affects mrab-regex versions >= 07dfa3b6b2d5a30919ac8564c1542a4487d40f8e, < 0e8cb0596ba6572c66e5d153a1d7c901b381e15e. Fixed in 0e8cb0596ba6572c66e5d153a1d7c901b381e15e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mrab-regex package is a Python library that provides an alternative implementation of regular expressions, offering enhanced features and performance compared to the built-in re module. It is widely used in various applications for string manipulation and pattern matching. However, the package has been identified to have a critical vulnerability that could lead to unexpected behavior and potential data exposure.
Vulnerability Detail
The vulnerability is classified as an UNKNOWN READ, which indicates that the software may attempt to read memory that it should not access. This can lead to crashes or unintended data leaks, posing a risk to applications that rely on the mrab-regex package. The issue was reported through OSS-Fuzz, highlighting its severity and the need for immediate attention.
How To Fix
Minimum fixed version
0e8cb0596ba6572c66e5d153a1d7c901b381e15e
This is the first release that contains the fix.
pip install --upgrade "mrab-regex==0e8cb0596ba6572c66e5d153a1d7c901b381e15e"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider using an alternative regex library or implementing a temporary solution that avoids the use of mrab-regex until the update can be applied.
Conclusion
The mrab-regex package has a critical UNKNOWN READ vulnerability that can lead to crashes and potential data leaks. It is essential to update to the patched version to mitigate risks. Users should also consider using Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for mrab-regex →
FAQ
mrab-regex is a Python library that provides an alternative implementation of regular expressions, offering additional features and improved performance.
UNKNOWN READ indicates that the software may attempt to read from an invalid memory location, which can lead to crashes or data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using an alternative regex library or implementing a temporary workaround to avoid using mrab-regex.
More details about this vulnerability can be found in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539159630.
References
Related vulnerabilities
Recent vulnerabilities recorded for mrab-regex.
