PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcre2-toolsUpgrade pcre2-syntaxUpgrade pcre2Upgrade pcre2-utf16Upgrade pcre2-develUpgrade pcre2-utf32 | Oct 13, 2026 | Oct 12, 2026 |
| Alpine Linux | — | Upgrade pcre2 | Oct 2, 2026 | Sep 5, 2026 |
| Debian | — | Upgrade pcre2 | Sep 21, 2026 | Sep 5, 2026 |
| Redhat_linux | — | Upgrade pcre2-staticUpgrade pcre2-tools-debuginfoUpgrade pcre2-utf32-debuginfoUpgrade pcre2-utf32Upgrade pcre2-debuginfoNo solution existsUpgrade pcre2-toolsUpgrade pcre2-develUpgrade pcre2-utf16-debuginfoUpgrade pcre2Upgrade pcre2-utf16Upgrade pcre2-syntaxUpgrade pcre2-debugsource | Sep 15, 2026 | Sep 5, 2026 |
| Rocky_linux | — | Upgrade pcre2-staticUpgrade pcre2-debugsourceUpgrade pcre2-utf16-debuginfoUpgrade pcre2-tools-debuginfoUpgrade pcre2-develUpgrade pcre2-utf16Upgrade pcre2-debuginfoUpgrade pcre2-toolsUpgrade pcre2Upgrade pcre2-utf32Upgrade pcre2-utf32-debuginfo | Oct 16, 2026 | Oct 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub