@rxGlobal CVE-2026-103932

Exploitation requires that the affected @rxGlobal component be used to evaluate attacker-influenced data with PCRE2. For the fail-open bypass: an application must rely on the regex result as a security decision, AND the attacker must be able to supply input expensive enough to hit PCRE2's match limit, at which point the fail-open error handling causes the limit error to be misinterpreted as a match - bypassing the control. For the crash: the attacker (or the application path) must be able to pass an invalid pattern into the engine, which the error handling does not safely reject. LIMITING FACTORS: impact is entirely conditional on integration - if the regex result is not used for a security decision, the fail-open has no security consequence; if patterns are static/developer-controlled, the invalid-pattern crash is not remotely reachable. Exact affected versions, the fixed release, attack vector, and authentication level are not confirmed from the available data and must be verified against the GHSA advisory and the Ubuntu report.

Risk cannot be quantified from first-party scoring signals because every key metric is missing: CVSS score and vector are N/A, and no EPSS probability, KEV listing, or POC indicator was provided. By the precision rules, this means no public exploit identified at time of analysis and no evidence of active exploitation - do NOT treat this as a weaponized or in-the-wild threat. The substantive risk is inferred from the advisory title alone (GHSA-5m93-4h75-3p2w) and is twofold and of genuinely different character: (1) a 'match-limit fail-open' defect, where exhausting PCRE2's computational match limit causes the error path to be treated as a successful match rather than an error, which can silently bypass any security control (input validation, denylist, WAF-style filter) built on top of the regex - an integrity/control-bypass issue; and (2) an 'invalid-pattern crash', a denial-of-service condition. Because no CVSS vector is supplied, authentication requirements are not confirmed from available data and attack vector/complexity cannot be derived from input - the real-world severity depends entirely on how the affected library is embedded (whether attacker input reaches the regex engine, and whether patterns are user-controllable). This is best treated as a 'verify before prioritizing' item: potentially serious as a security-control bypass, but currently unscored and unconfirmed for exploitation.

An application uses the affected @rxGlobal PCRE2 wrapper to enforce an allow/deny input filter; an attacker submits input crafted to exhaust PCRE2's match limit, and because the error is handled fail-open, the malicious input is treated as matching (or passing) the filter and the security check is bypassed. Alternatively, an attacker who can supply a regex pattern sends an invalid pattern to trigger the unhandled error path and crash the process (DoS). No public exploit code was identified in the provided data.