An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcre2Upgrade pcre2-develUpgrade pcre2-utf32Upgrade pcre2-utf16Upgrade pcre2-tools | Aug 11, 2022 | May 16, 2022 |
| Alpine Linux | — | Upgrade pcre2 | Mar 26, 2024 | May 16, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pcre2-staticUpgrade pcre2Upgrade pcre2-utf16Upgrade pcre2-utf32Upgrade pcre2-develUpgrade pcre2-toolsUpgrade pcre2-debuginfo | Nov 10, 2022 | May 16, 2022 |
| Amazon_linux_2023 | — | Upgrade pcre2-tools-debuginfoUpgrade pcre2Upgrade pcre2-syntaxUpgrade pcre2-develUpgrade pcre2-debuginfoUpgrade pcre2-utf32Upgrade pcre2-utf16Upgrade pcre2-utf16-debuginfoUpgrade pcre2-utf32-debuginfoUpgrade pcre2-toolsUpgrade pcre2-staticUpgrade pcre2-debugsource | Feb 17, 2025 | Mar 23, 2022 |
| Centos_linux | — | Upgrade pcre2-utf32-debuginfoUpgrade pcre2-debuginfoUpgrade pcre2-debugsourceUpgrade pcre2-utf16-debuginfoUpgrade pcre2-develUpgrade pcre2-syntaxUpgrade pcre2-utf16Upgrade pcre2-utf32Upgrade pcre2-tools-debuginfoUpgrade pcre2 | Jul 5, 2022 | May 16, 2022 |
| Debian | — | Upgrade pcre2 | Mar 17, 2023 | May 16, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade pcre2 | Aug 18, 2022 | May 16, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pcre2 | Aug 18, 2022 | May 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pcre2-utf32Upgrade pcre2-utf16Upgrade pcre2-develUpgrade pcre2 | Jun 22, 2022 | May 16, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade pcre2 | Sep 14, 2022 | May 16, 2022 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Sep 1, 2026 | May 16, 2022 |
| Oracle_linux | — | Upgrade pcre2-utf32Upgrade pcre2Upgrade pcre2-develUpgrade pcre2-syntaxUpgrade pcre2-utf16Upgrade pcre2-tools | Aug 3, 2022 | Mar 23, 2022 |
| Redhat_linux | — | Upgrade pcre2-debugsourceUpgrade pcre2Upgrade pcre2-utf16-debuginfoUpgrade pcre2-develUpgrade pcre2-toolsUpgrade pcre2-debuginfoUpgrade pcre2-utf16Upgrade pcre2-syntaxUpgrade pcre2-utf32-debuginfoUpgrade pcre2-utf32Upgrade pcre2-tools-debuginfo | Jul 5, 2022 | May 16, 2022 |
| Rocky_linux | — | Upgrade pcre2-utf32-debuginfoUpgrade pcre2-utf16Upgrade pcre2-utf32Upgrade pcre2Upgrade pcre2-tools-debuginfoUpgrade pcre2-debugsourceUpgrade pcre2-develUpgrade pcre2-debuginfoUpgrade pcre2-toolsUpgrade pcre2-utf16-debuginfo | Mar 12, 2024 | May 16, 2022 |
| Suse | — | Upgrade libpcre2-8-0-32bitUpgrade libpcrecpp0-32bitUpgrade libpcre1Upgrade pcre2-devel-staticUpgrade pcre-develUpgrade libpcre16-0-32bitUpgrade pcre-devel-staticUpgrade pcre-docUpgrade libpcre2-8-0Upgrade libpcre2-16-0-32bitUpgrade libpcrecpp0Upgrade libpcre2-posix2-32bitUpgrade libpcre2-posix2Upgrade libpcre2-16-0Upgrade libpcreposix0Upgrade libpcre16-0Upgrade libpcre1-32bitUpgrade pcre2-develUpgrade libpcre2-32-0Upgrade pcre2-toolsUpgrade pcre2-docUpgrade libpcre2-32-0-32bitUpgrade pcre-toolsUpgrade libpcreposix0-32bit | Oct 26, 2022 | May 16, 2022 |
| Ubuntu | — | Upgrade libpcre2-posix0 (Ubuntu Pro)Upgrade libpcre2-8-0Upgrade libpcre2-posix2Upgrade libpcre2-32-0 (Ubuntu Pro)Upgrade libpcre2-32-0Upgrade libpcre2-16-0Upgrade libpcre2-8-0 (Ubuntu Pro)Upgrade libpcre2-16-0 (Ubuntu Pro)Upgrade libpcre2-posix3Upgrade pcre2-utilsUpgrade pcre2-utils (Ubuntu Pro) | Sep 23, 2022 | May 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub