An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-gdUpgrade libzipUpgrade php-pecl-rrdUpgrade php-embeddedUpgrade php-bcmathUpgrade php-cliUpgrade pcre2-develUpgrade php-xmlUpgrade php-mysqlndUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-ldapUpgrade pcre2-utf32Upgrade apcu-panelUpgrade libzip-develUpgrade php-intlUpgrade pcre2Upgrade phpUpgrade php-snmpUpgrade pcre2-utf16Upgrade php-processUpgrade php-recodeUpgrade php-enchantUpgrade php-gmpUpgrade php-commonUpgrade php-pecl-zipUpgrade php-pearUpgrade php-pdoUpgrade php-dbaUpgrade php-mbstringUpgrade php-dbgUpgrade php-soapUpgrade php-pecl-xdebugUpgrade php-odbcUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade pcre2-toolsUpgrade php-pecl-apcuUpgrade php-devel | May 4, 2022 | Feb 14, 2020 |
| Centos_linux | — | Upgrade php-json-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pearUpgrade php-recodeUpgrade php-cliUpgrade php-develUpgrade php-jsonUpgrade php-snmpUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade pcre2-debugsourceUpgrade php-pecl-xdebugUpgrade pcre2-utf32-debuginfoUpgrade php-xmlUpgrade pcre2-utf16-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-develUpgrade php-dba-debuginfoUpgrade php-bcmathUpgrade php-odbcUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade libzip-debuginfoUpgrade php-fpmUpgrade php-ldapUpgrade php-mysqlndUpgrade php-gd-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debugsourceUpgrade php-gmpUpgrade pcre2-tools-debuginfoUpgrade php-enchant-debuginfoUpgrade pcre2-develUpgrade pcre2-utf16Upgrade pcre2-utf32Upgrade php-commonUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-pecl-rrd-debuginfoUpgrade php-common-debuginfoUpgrade php-xmlrpcUpgrade php-recode-debuginfoUpgrade php-pdoUpgrade pcre2Upgrade php-mysqlnd-debuginfoUpgrade libzipUpgrade php-xml-debuginfoUpgrade php-intlUpgrade php-enchantUpgrade php-cli-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade libzip-tools-debuginfoUpgrade apcu-panelUpgrade php-pecl-zipUpgrade php-opcache-debuginfoUpgrade php-ldap-debuginfoUpgrade php-debugsourceUpgrade phpUpgrade php-bcmath-debuginfoUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-processUpgrade php-gdUpgrade php-snmp-debuginfoUpgrade php-process-debuginfoUpgrade pcre2-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbg-debuginfoUpgrade php-mbstringUpgrade php-fpm-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-dbaUpgrade php-pgsql-debuginfoUpgrade php-debuginfoUpgrade php-intl-debuginfoUpgrade libzip-toolsUpgrade php-embedded-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-apcu-debuginfoUpgrade php-embeddedUpgrade php-soap-debuginfo | Sep 9, 2020 | Feb 14, 2020 |
| Debian | — | Upgrade pcre2 | Mar 17, 2023 | Feb 14, 2020 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Gentoo Linux | — | Upgrade net-libs/pcre2. | Jun 16, 2020 | Feb 14, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pcre2-develUpgrade pcre2-utf32Upgrade pcre2Upgrade pcre2-utf16 | Apr 21, 2020 | Feb 14, 2020 |
| Oracle Solaris | — | Upgrade library/pcre2 to version 10.34-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Feb 14, 2020 |
| Oracle_linux | — | Upgrade pcre2-toolsUpgrade php-embeddedUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-jsonUpgrade php-intlUpgrade php-processUpgrade php-odbcUpgrade php-pgsqlUpgrade apcu-panelUpgrade php-dbaUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade php-gmpUpgrade libzip-toolsUpgrade php-soapUpgrade libzipUpgrade phpUpgrade php-fpmUpgrade php-snmpUpgrade php-commonUpgrade php-mbstringUpgrade libzip-develUpgrade php-develUpgrade php-recodeUpgrade php-bcmathUpgrade php-pearUpgrade php-cliUpgrade pcre2-utf32Upgrade php-pecl-apcuUpgrade php-opcacheUpgrade pcre2-utf16Upgrade php-xmlrpcUpgrade php-ldapUpgrade pcre2-develUpgrade php-xmlUpgrade php-pdoUpgrade pcre2Upgrade php-pecl-xdebugUpgrade php-dbgUpgrade php-mysqlnd | Sep 10, 2020 | Jul 28, 2019 |
| Redhat_linux | — | Upgrade pcre2Upgrade pcre2-utf16-debuginfoUpgrade php-recodeUpgrade php-debuginfoUpgrade php-opcacheUpgrade php-soap-debuginfoUpgrade php-mysqlndUpgrade php-ldapUpgrade pcre2-develUpgrade php-debugsourceUpgrade php-fpm-debuginfoUpgrade phpUpgrade pcre2-utf32Upgrade apcu-panelUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xmlUpgrade php-pecl-apcu-debuginfoUpgrade php-recode-debuginfoUpgrade php-intlUpgrade php-embeddedUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade pcre2-utf16Upgrade php-bcmath-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade pcre2-tools-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-common-debuginfoUpgrade php-opcache-debuginfoUpgrade libzip-develUpgrade php-cliNo solution existsUpgrade php-snmpUpgrade php-jsonUpgrade php-enchant-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzipUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-process-debuginfoUpgrade php-pdo-debuginfoUpgrade pcre2-debugsourceUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-fpmUpgrade php-processUpgrade php-intl-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-xml-debuginfoUpgrade pcre2-debuginfoUpgrade libzip-debugsourceUpgrade php-json-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-zip-debugsourceUpgrade libzip-debuginfoUpgrade php-pgsqlUpgrade php-soapUpgrade pcre2-utf32-debuginfoUpgrade php-pearUpgrade php-dbaUpgrade php-commonUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-odbcUpgrade php-develUpgrade php-mbstring-debuginfoUpgrade php-enchantUpgrade php-gmpUpgrade php-cli-debuginfoUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade pcre2-toolsUpgrade php-odbc-debuginfo | Sep 9, 2020 | Feb 14, 2020 |
| Rocky_linux | — | Upgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-bcmath-debuginfoUpgrade pcre2-debugsourceUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade pcre2-debuginfoUpgrade php-intlUpgrade pcre2Upgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-mbstringUpgrade libzip-develUpgrade php-pecl-zip-debugsourceUpgrade php-dbgUpgrade php-pdo-debuginfoUpgrade php-jsonUpgrade php-gd-debuginfoUpgrade php-xml-debuginfoUpgrade pcre2-utf16Upgrade pcre2-utf32-debuginfoUpgrade libzip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-soapUpgrade php-gmpUpgrade php-odbc-debuginfoUpgrade php-pecl-apcuUpgrade libzipUpgrade phpUpgrade php-develUpgrade php-cli-debuginfoUpgrade php-debugsourceUpgrade php-pecl-zipUpgrade php-pgsqlUpgrade php-embeddedUpgrade pcre2-tools-debuginfoUpgrade php-ldapUpgrade php-bcmathUpgrade pcre2-toolsUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-enchant-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-fpmUpgrade php-embedded-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-enchantUpgrade php-dbaUpgrade php-gmp-debuginfoUpgrade php-odbcUpgrade pcre2-utf16-debuginfoUpgrade php-commonUpgrade libzip-debuginfoUpgrade php-xmlrpcUpgrade php-opcacheUpgrade php-processUpgrade php-recode-debuginfoUpgrade php-snmp-debuginfoUpgrade php-process-debuginfoUpgrade php-mysqlndUpgrade php-cliUpgrade php-snmpUpgrade php-mbstring-debuginfoUpgrade php-common-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pgsql-debuginfoUpgrade pcre2-utf32Upgrade php-soap-debuginfoUpgrade php-intl-debuginfoUpgrade pcre2-develUpgrade php-pecl-rrd-debugsourceUpgrade libzip-toolsUpgrade php-xmlUpgrade php-recodeUpgrade php-pecl-rrdUpgrade php-dbg-debuginfoUpgrade php-dba-debuginfo | Mar 12, 2024 | Feb 14, 2020 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Universal Forwarder to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Universal Forwarder to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Feb 14, 2020 |
| Suse | — | Upgrade pcre2-docUpgrade libpcre2-8-0Upgrade libpcre2-8-0-32bitUpgrade libpcre2-posix2Upgrade pcre2-toolsUpgrade libpcre2-32-0-32bitUpgrade libpcre2-16-0-32bitUpgrade libpcre2-posix2-32bitUpgrade pcre2-devel-staticUpgrade pcre2-develUpgrade libpcre2-16-0Upgrade libpcre2-32-0 | Aug 9, 2024 | Feb 14, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub