Critical UNKNOWN READ Vulnerability in mrab-regex Package
Summary
OSV-2026-1070: UNKNOWN READ in bytes1_char_at. Affects mrab-regex versions >= 07dfa3b6b2d5a30919ac8564c1542a4487d40f8e, < 0e8cb0596ba6572c66e5d153a1d7c901b381e15e. Fixed in 0e8cb0596ba6572c66e5d153a1d7c901b381e15e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mrab-regex package is a Python library that provides regular expression matching capabilities. It is widely used for string manipulation and pattern matching in various applications. The package is designed to be efficient and flexible, allowing developers to implement complex regex functionalities. However, it has recently been identified to have a vulnerability that could lead to unexpected behavior or crashes, particularly when handling certain Unicode characters.
Vulnerability Detail
The vulnerability is classified as an UNKNOWN READ in the bytes1_char_at function, which can lead to crashes during execution. This issue was reported by OSS-Fuzz, indicating that it can occur when the library attempts to read memory that it should not access, potentially leading to application instability or crashes. The crash state involves functions like unicode_word_left and unicode_at_boundary, which are critical for processing Unicode strings. If exploited, this vulnerability could disrupt applications relying on mrab-regex for regex operations, leading to denial of service or data corruption.
How To Fix
Minimum fixed version
0e8cb0596ba6572c66e5d153a1d7c901b381e15e
This is the first release that contains the fix.
pip install --upgrade "mrab-regex==0e8cb0596ba6572c66e5d153a1d7c901b381e15e"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you cannot update the package immediately, consider implementing input validation to sanitize the data being processed by mrab-regex. This can help mitigate the risk of triggering the vulnerability until a proper update can be applied.
Conclusion
The mrab-regex package has a critical UNKNOWN READ vulnerability that can lead to application crashes. It is essential to update to the latest version to mitigate risks. Users should also consider implementing input validation as a temporary measure until the update can be applied.
See every vulnerability recorded for mrab-regex →
FAQ
mrab-regex is a Python library that provides functionalities for regular expression matching, allowing developers to perform complex string manipulations.
The UNKNOWN READ vulnerability allows the application to attempt reading memory that it should not access, potentially leading to crashes or unstable behavior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement input validation to sanitize inputs processed by mrab-regex as a temporary workaround.
You can visit Vulert at https://vulert.com, which monitors and alerts for open-source vulnerabilities in real-time using your Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for mrab-regex.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
