Pcre2
Monthly
Out-of-bounds write in PCRE2, the regular-expression library embedded in PHP, nginx, Apache httpd, Git and numerous language runtimes, allows memory corruption when a consuming application compiles an attacker-controlled pattern through the JIT compilation API in the manner described by the vendor advisory. Only releases before 10.49 are affected, and exploitation is gated on two conditions holding at once: the application must accept untrusted, user-supplied regexes and must route them through PCRE2's JIT path, so default library presence alone does not imply exploitability. The assessed vector is network-reachable with high attack complexity and no privileges required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, base 7.6); no public exploit code and no CISA KEV entry were identified at time of analysis. A vendor patch is available per the advisory, so upgrading to a fixed release remediates.
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). A vendor fix exists in PCRE2 10.48 (upstream PR #937), so the residual risk is low despite the total technical impact rating.
An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on 32-bit builds where size_t is 32 bits - 64-bit systems are unaffected. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4), yet it is sharply constrained: the consuming application must actually invoke the comparatively rarely-used convert entry point and pass it a large, attacker-supplied pattern, which is why AC:H applies and the SSVC assessment rates automatic exploitation as not feasible. Publicly available exploit code exists per the SSVC exploitation signal (POC), although there is no confirmed actively exploited (CISA KEV) status; EPSS is low at 0.10% (1st percentile), reflecting the narrow 32-bit-plus-convert-API precondition. Impact is high integrity and availability with no confidentiality loss, consistent with memory corruption via integer overflow leading to under-allocation.
Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached workspace block is reused in a recursive context without the size check that guards a freshly allocated block of the same type. Applications that pass attacker-controlled regular expressions to pcre2_dfa_match, or that configure a small heap limit via the PCRE2 API while processing recursive patterns, are exploitable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, PCRE2 10.48 ships a confirmed vendor fix alongside four other security patches in the same release.
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF option is active and a subject string containing invalid UTF sequences is matched. The flaw occurs during backward scanning through invalid UTF data, where the lower buffer bound is not enforced, potentially crashing the calling application. The official CVSS score of 3.7 reflects high attack complexity and an impact limited to partial availability loss, with no confidentiality or integrity consequences confirmed. No public exploit has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Out-of-bounds read in PCRE2 before 10.48 can produce a limited availability impact when an attacker supplies invalid UTF-encoded data to an application that JIT-compiled patterns for one match mode but then calls pcre2_match with a different mode, triggering a JIT fallback with inconsistent internal state. The flaw is tracked as GHSA-2p8c-ff85-vh9x and was corrected in the PCRE2 10.48 release alongside four other security fixes. No public exploit code and no active exploitation have been identified at time of analysis; the low CVSS score of 2.9 and high attack complexity reflect the narrow, configuration-dependent preconditions required.
Two-byte memory disclosure in PCRE2's pcre2_serialize_encode function exposes a small amount of potentially sensitive memory to local adversaries who already have some form of unsafe process access. All PCRE2 releases prior to 10.48 are affected across all supported platforms, per CPE cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified; the vendor advisory explicitly qualifies that exploitation occurs in contexts where the adversary's access is already unsafe, substantially constraining real-world impact beyond the minimal two-byte leak.
The PCRE2 library is a set of C functions that implement regular expression pattern matching. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures.". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.3%.
Out-of-bounds write in PCRE2, the regular-expression library embedded in PHP, nginx, Apache httpd, Git and numerous language runtimes, allows memory corruption when a consuming application compiles an attacker-controlled pattern through the JIT compilation API in the manner described by the vendor advisory. Only releases before 10.49 are affected, and exploitation is gated on two conditions holding at once: the application must accept untrusted, user-supplied regexes and must route them through PCRE2's JIT path, so default library presence alone does not imply exploitability. The assessed vector is network-reachable with high attack complexity and no privileges required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, base 7.6); no public exploit code and no CISA KEV entry were identified at time of analysis. A vendor patch is available per the advisory, so upgrading to a fixed release remediates.
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). A vendor fix exists in PCRE2 10.48 (upstream PR #937), so the residual risk is low despite the total technical impact rating.
An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on 32-bit builds where size_t is 32 bits - 64-bit systems are unaffected. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4), yet it is sharply constrained: the consuming application must actually invoke the comparatively rarely-used convert entry point and pass it a large, attacker-supplied pattern, which is why AC:H applies and the SSVC assessment rates automatic exploitation as not feasible. Publicly available exploit code exists per the SSVC exploitation signal (POC), although there is no confirmed actively exploited (CISA KEV) status; EPSS is low at 0.10% (1st percentile), reflecting the narrow 32-bit-plus-convert-API precondition. Impact is high integrity and availability with no confidentiality loss, consistent with memory corruption via integer overflow leading to under-allocation.
Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached workspace block is reused in a recursive context without the size check that guards a freshly allocated block of the same type. Applications that pass attacker-controlled regular expressions to pcre2_dfa_match, or that configure a small heap limit via the PCRE2 API while processing recursive patterns, are exploitable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, PCRE2 10.48 ships a confirmed vendor fix alongside four other security patches in the same release.
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF option is active and a subject string containing invalid UTF sequences is matched. The flaw occurs during backward scanning through invalid UTF data, where the lower buffer bound is not enforced, potentially crashing the calling application. The official CVSS score of 3.7 reflects high attack complexity and an impact limited to partial availability loss, with no confidentiality or integrity consequences confirmed. No public exploit has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Out-of-bounds read in PCRE2 before 10.48 can produce a limited availability impact when an attacker supplies invalid UTF-encoded data to an application that JIT-compiled patterns for one match mode but then calls pcre2_match with a different mode, triggering a JIT fallback with inconsistent internal state. The flaw is tracked as GHSA-2p8c-ff85-vh9x and was corrected in the PCRE2 10.48 release alongside four other security fixes. No public exploit code and no active exploitation have been identified at time of analysis; the low CVSS score of 2.9 and high attack complexity reflect the narrow, configuration-dependent preconditions required.
Two-byte memory disclosure in PCRE2's pcre2_serialize_encode function exposes a small amount of potentially sensitive memory to local adversaries who already have some form of unsafe process access. All PCRE2 releases prior to 10.48 are affected across all supported platforms, per CPE cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified; the vendor advisory explicitly qualifies that exploitation occurs in contexts where the adversary's access is already unsafe, substantially constraining real-world impact beyond the minimal two-byte leak.
The PCRE2 library is a set of C functions that implement regular expression pattern matching. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures.". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.3%.