Summary
The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl.
Security Fix(es):
* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)
* pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157)
* PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158)
* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | pcre2 | 10.32-4.el8_10 |
| AlmaLinux · 8 | pcre2-devel | 10.32-4.el8_10 |
| AlmaLinux · 8 | pcre2-tools | 10.32-4.el8_10 |
| AlmaLinux · 8 | pcre2-utf16 | 10.32-4.el8_10 |
| AlmaLinux · 8 | pcre2-utf32 | 10.32-4.el8_10 |
Vulnerabilities 4
-
High 8.2
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursi…
-
High 7.6
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of…
-
Medium 6.5
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
-
Medium 5.7
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-103111
-
report
https://access.redhat.com/security/cve/CVE-2026-86145
-
report
https://access.redhat.com/security/cve/CVE-2026-89157
-
report
https://access.redhat.com/security/cve/CVE-2026-89158
-
report
https://bugzilla.redhat.com/2528993
-
report
https://bugzilla.redhat.com/2531744
-
report
https://bugzilla.redhat.com/2531746
-
report
https://bugzilla.redhat.com/2543797
-
advisory
https://errata.almalinux.org/8/ALSA-2026-81613.html