An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade php-pearUpgrade pcre2-toolsUpgrade php-soapUpgrade php-pdoUpgrade php-mbstringUpgrade php-gmpUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-pecl-zipUpgrade php-fpmUpgrade php-jsonUpgrade php-commonUpgrade php-odbcUpgrade php-develUpgrade php-embeddedUpgrade php-processUpgrade php-pecl-rrdUpgrade php-xmlUpgrade php-intlUpgrade libzip-toolsUpgrade php-ldapUpgrade libzipUpgrade php-opcacheUpgrade libzip-develUpgrade php-recodeUpgrade pcre2Upgrade phpUpgrade apcu-panelUpgrade php-cliUpgrade php-bcmathUpgrade pcre2-utf32Upgrade php-snmpUpgrade php-mysqlndUpgrade php-enchantUpgrade pcre2-utf16Upgrade pcre2-develUpgrade php-gd | May 4, 2022 | Feb 14, 2020 |
| Centos_linux | — | Upgrade php-opcacheUpgrade php-dba-debuginfoUpgrade pcre2-utf16Upgrade php-pecl-rrd-debuginfoUpgrade libzip-develUpgrade php-gmp-debuginfoUpgrade php-commonUpgrade pcre2Upgrade pcre2-utf32Upgrade php-pecl-rrd-debugsourceUpgrade php-common-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade pcre2-utf16-debuginfoUpgrade php-dbgUpgrade pcre2-tools-debuginfoUpgrade php-cliUpgrade php-pearUpgrade php-pecl-apcuUpgrade pcre2-utf32-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-mbstring-debuginfoUpgrade pcre2-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-fpmUpgrade php-xmlUpgrade php-snmpUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-pecl-zip-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade pcre2-develUpgrade libzipUpgrade php-pdoUpgrade php-recode-debuginfoUpgrade php-odbcUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlndUpgrade php-json-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-enchant-debuginfoUpgrade php-gd-debuginfoUpgrade php-ldapUpgrade libzip-debuginfoUpgrade php-bcmathUpgrade libzip-tools-debuginfoUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-bcmath-debuginfoUpgrade php-mbstringUpgrade php-gdUpgrade php-debugsourceUpgrade apcu-panelUpgrade php-soapUpgrade php-fpm-debuginfoUpgrade php-intlUpgrade php-pecl-rrdUpgrade php-dbaUpgrade php-pdo-debuginfoUpgrade php-cli-debuginfoUpgrade php-processUpgrade php-intl-debuginfoUpgrade libzip-toolsUpgrade php-debuginfoUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php-dbg-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-odbc-debuginfoUpgrade php-enchantUpgrade php-snmp-debuginfoUpgrade libzip-debugsourceUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pgsqlUpgrade php-process-debuginfoUpgrade pcre2-debuginfoUpgrade php-pecl-zip | Sep 9, 2020 | Feb 14, 2020 |
| Debian | — | Upgrade pcre2 | Mar 17, 2023 | Feb 14, 2020 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Gentoo Linux | — | Upgrade net-libs/pcre2. | Jun 16, 2020 | Feb 14, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pcre2-utf32Upgrade pcre2-utf16Upgrade pcre2-develUpgrade pcre2 | Apr 21, 2020 | Feb 14, 2020 |
| Oracle Solaris | — | Upgrade library/pcre2 to version 10.34-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Feb 14, 2020 |
| Oracle_linux | — | Upgrade php-dbaUpgrade libzipUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-gmpUpgrade phpUpgrade php-jsonUpgrade apcu-panelUpgrade pcre2-toolsUpgrade php-soapUpgrade php-embeddedUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-processUpgrade php-intlUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-gdUpgrade php-fpmUpgrade php-recodeUpgrade php-pearUpgrade php-commonUpgrade libzip-develUpgrade php-snmpUpgrade php-mbstringUpgrade php-dbgUpgrade php-xmlrpcUpgrade php-ldapUpgrade pcre2Upgrade php-pecl-xdebugUpgrade php-mysqlndUpgrade php-pdoUpgrade pcre2-develUpgrade php-xmlUpgrade php-develUpgrade pcre2-utf32Upgrade php-bcmathUpgrade php-cliUpgrade php-opcacheUpgrade pcre2-utf16Upgrade php-pecl-apcu | Sep 10, 2020 | Jul 28, 2019 |
| Redhat_linux | — | Upgrade php-enchant-debuginfoUpgrade php-pearUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-pecl-apcu-debugsourceUpgrade php-odbcUpgrade php-dbaUpgrade pcre2-utf32-debuginfoUpgrade libzip-debugsourceUpgrade pcre2-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-dbgUpgrade php-odbc-debuginfoUpgrade php-gd-debuginfoUpgrade php-pgsqlUpgrade php-bcmathUpgrade php-pecl-xdebugUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-zipUpgrade php-soapUpgrade php-cli-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-processUpgrade php-pdoUpgrade php-gmpUpgrade php-pecl-apcuUpgrade pcre2-toolsUpgrade libzipUpgrade libzip-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-rrdUpgrade php-xml-debuginfoUpgrade php-enchantUpgrade php-dba-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebug-debugsourceUpgrade php-gdUpgrade php-jsonUpgrade php-develUpgrade pcre2-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-cliUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-mysqlndUpgrade php-debugsourceUpgrade php-recode-debuginfoUpgrade php-snmp-debuginfoNo solution existsUpgrade pcre2Upgrade pcre2-utf16Upgrade php-recodeUpgrade php-embeddedUpgrade php-snmpUpgrade php-fpm-debuginfoUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade phpUpgrade php-soap-debuginfoUpgrade pcre2-utf16-debuginfoUpgrade pcre2-develUpgrade php-dbg-debuginfoUpgrade libzip-develUpgrade php-ldap-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-debuginfoUpgrade apcu-panelUpgrade php-intlUpgrade pcre2-tools-debuginfoUpgrade php-ldapUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade pcre2-utf32Upgrade php-bcmath-debuginfoUpgrade php-common-debuginfoUpgrade libzip-toolsUpgrade php-opcache | Sep 9, 2020 | Feb 14, 2020 |
| Rocky_linux | — | Upgrade php-json-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-soap-debuginfoUpgrade pcre2-debuginfoUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-snmpUpgrade pcre2-debugsourceUpgrade libzip-develUpgrade php-mbstringUpgrade php-bcmath-debuginfoUpgrade php-odbcUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade pcre2-utf16-debuginfoUpgrade php-processUpgrade php-mysqlnd-debuginfoUpgrade php-cliUpgrade libzip-debuginfoUpgrade php-intl-debuginfoUpgrade pcre2Upgrade php-xmlUpgrade pcre2-utf32Upgrade php-commonUpgrade php-recode-debuginfoUpgrade pcre2-develUpgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-dbg-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-opcacheUpgrade php-fpm-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-intlUpgrade php-process-debuginfoUpgrade php-ldap-debuginfoUpgrade php-snmp-debuginfoUpgrade php-recodeUpgrade php-dba-debuginfoUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade libzip-debugsourceUpgrade php-embeddedUpgrade php-pdoUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-gdUpgrade php-pecl-xdebugUpgrade pcre2-toolsUpgrade php-soapUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pdo-debuginfoUpgrade pcre2-utf16Upgrade php-bcmathUpgrade php-enchant-debuginfoUpgrade pcre2-utf32-debuginfoUpgrade php-dbaUpgrade php-dbgUpgrade php-fpmUpgrade php-xml-debuginfoUpgrade php-develUpgrade php-xmlrpc-debuginfoUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu-debugsourceUpgrade php-jsonUpgrade libzipUpgrade php-cli-debuginfoUpgrade php-odbc-debuginfoUpgrade php-gmpUpgrade pcre2-tools-debuginfoUpgrade php-pecl-apcuUpgrade php-embedded-debuginfoUpgrade php-enchantUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-zipUpgrade php-ldapUpgrade php-debugsource | Mar 12, 2024 | Feb 14, 2020 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Universal Forwarder to version 9.1.1Upgrade Splunk Universal Forwarder to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Universal Forwarder to version 9.0.6 | Sep 30, 2025 | Feb 14, 2020 |
| Suse | — | Upgrade pcre2-toolsUpgrade libpcre2-posix2Upgrade libpcre2-posix2-32bitUpgrade pcre2-docUpgrade libpcre2-8-0-32bitUpgrade libpcre2-8-0Upgrade libpcre2-16-0-32bitUpgrade libpcre2-32-0-32bitUpgrade pcre2-develUpgrade libpcre2-16-0Upgrade pcre2-devel-staticUpgrade libpcre2-32-0 | Aug 9, 2024 | Feb 14, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub