Every CVE Search/ Get API key

CVE-2022-41409

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of...

7.5 HighFix available

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.12%Up 1.1 points since Jul 19, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
CVE-2022-41409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
CVE-2022-41409
Updated
2026-11-02
EUVDEUVD-2022-44602 No score

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
EUVD-2022-44602
Updated
2026-11-03
GitHub AdvisoriesGHSA-4qfx-v7wh-3q4j 7.5

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of...

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
GHSA-4qfx-v7wh-3q4j
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2022-41409 7.5

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
ALPINE-CVE-2022-41409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-27500 7.5

CVE-2022-41409 affecting package pcre2 for versions less than 10.42-1

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
AZL-27500
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVBELL-CVE-2022-41409 7.5

CVE-2022-41409 does not affect BellSoft software

Record
BELL-CVE-2022-41409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-41409 7.5

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
DEBIAN-CVE-2022-41409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVJLSEC-2026-59 7.5

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
JLSEC-2026-59
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1482 7.5

pcre2 security update

PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API.

Security Fix(es):

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.(CVE-2022-41409)

Record
OESA-2023-1482
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2204-CVE-2022-41409 7.5

CVE-2022-41409 in pcre2 - Patched by Root

Root has patched CVE-2022-41409 in the pcre2 package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2204-CVE-2022-41409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVUBUNTU-CVE-2022-41409 7.5

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
UBUNTU-CVE-2022-41409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVCLSA-2026-1777308424 No score

pcre2: Fix of CVE-2022-41409

  • CVE-2022-41409 diagnose negative repeat value in pcre2test subject line (upstream 94e1c001) and change pcre2grep length variables from int to size_t to reject negative --buffer-size / --max-buffer-size (upstream 7549fdca)
Record
CLSA-2026-1777308424
Updated
2026-11-02
OSVCLSA-2026-1777454082 No score

pcre2: Fix of 2 CVEs

  • CVE-2022-1586: fix out-of-bounds read in JIT compile_xclass_matchingpath
  • CVE-2022-41409: diagnose negative repeat value in pcre2test
Record
CLSA-2026-1777454082
Updated
2026-11-02
OSVCLSA-2026-1777454193 No score

pcre2: Fix of 2 CVEs

  • CVE-2022-1586: fix out-of-bounds read in JIT compile_xclass_matchingpath
  • CVE-2022-41409: diagnose negative repeat value in pcre2test
Record
CLSA-2026-1777454193
Updated
2026-11-02
OSV No score

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Record
CVE-2022-41409
Updated
2026-11-02
OSVSUSE-SU-2023:3210-1 No score

Security update for pcre2

This update for pcre2 fixes the following issues:

  • CVE-2022-41409: Fixed integer overflow vulnerability in pcre2test that allows attackers to cause a denial of service via negative input (bsc#1213514).
Record
SUSE-SU-2023:3210-1
Updated
2026-11-02
OSVSUSE-SU-2023:3327-1 No score

Security update for pcre2

This update for pcre2 fixes the following issues:

  • CVE-2022-41409: Fixed integer overflow vulnerability in pcre2test that allows attackers to cause a denial of service via negative input (bsc#1213514).
Record
SUSE-SU-2023:3327-1
Updated
2026-11-02
OSVSUSE-SU-2023:3328-1 No score

Security update for pcre2

This update for pcre2 fixes the following issues:

  • CVE-2022-41409: Fixed integer overflow vulnerability in pcre2test that allows attackers to cause a denial of service via negative input (bsc#1213514).
Record
SUSE-SU-2023:3328-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pcre2
Alpine:v3.15
 before 10.42-r0
10.42-r0
pcre2
Alpine:v3.16
 before 10.42-r0
10.42-r0
pcre2
Alpine:v3.17
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.18
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.19
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.20
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.21
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.22
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.23
 before 10.41-r0
10.41-r0
pcre2
Alpine:v3.24
 before 10.41-r0
10.41-r0
Show 50 moreShow less
Affected packages
PackageAffectedFixed
pcre2
Azure Linux:2
 before 10.42-1
10.42-1
pcre2
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2-devel
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2-static
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2-syntax
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2-tools
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2-utf16
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2-utf32
TuxCare:AlmaLinux:9.2
 before 10.40-2.el9.tuxcare.els1
10.40-2.el9.tuxcare.els1
pcre2
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-devel
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-static
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-tools
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-utf16
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-utf32
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-devel
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-static
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-tools
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-utf16
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2-utf32
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 10.23-2.el7.tuxcare.els1
10.23-2.el7.tuxcare.els1
pcre2
Debian:12
 before 10.42-1
10.42-1
pcre2
Debian:13
 before 10.42-1
10.42-1
pcre2
Debian:14
 before 10.42-1
10.42-1
PCRE2_jll
Julia
 before 10.41.0+0
10.41.0+0
pcre2
openEuler:20.03-LTS-SP1
 before 10.35-5.oe1
10.35-5.oe1
pcre2
openEuler:20.03-LTS-SP3
 before 10.35-5.oe1
10.35-5.oe1
pcre2
openEuler:22.03-LTS
 before 10.39-9.oe2203sp2
10.39-9.oe2203sp2
pcre2
openEuler:22.03-LTS-SP1
 before 10.39-9.oe2203sp1
10.39-9.oe2203sp1
pcre2
openEuler:22.03-LTS-SP2
 before 10.39-9.oe2203sp2
10.39-9.oe2203sp2
pcre2
Root:Ubuntu:22.04
 before 10.39-3ubuntu0.2.aikido.6
10.39-3ubuntu0.2.aikido.6
rootio-pcre2
Root:Ubuntu:22.04
 before 10.39-3ubuntu0.2.aikido.6
10.39-3ubuntu0.2.aikido.6
pcre2
SUSE:Manager Proxy 4.2
 before 10.31-150000.3.15.1
10.31-150000.3.15.1
pcre2
SUSE:Manager Server 4.2
 before 10.31-150000.3.15.1
10.31-150000.3.15.1
pcre2
SUSE:Linux Enterprise Micro 5.1
 before 10.31-150000.3.15.1
10.31-150000.3.15.1
pcre2
SUSE:Linux Enterprise Micro 5.2
 before 10.31-150000.3.15.1
10.31-150000.3.15.1
pcre2
SUSE:Linux Enterprise Micro 5.3
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
SUSE:Linux Enterprise Micro 5.4
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
openSUSE:Leap Micro 5.3
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
openSUSE:Leap Micro 5.4
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
openSUSE:Leap 15.4
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
openSUSE:Leap 15.5
 before 10.39-150400.4.9.1
10.39-150400.4.9.1
pcre2
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 10.34-1.13.1
10.34-1.13.1
pcre2
SUSE:Linux Enterprise Server 12 SP5
 before 10.34-1.13.1
10.34-1.13.1
pcre2
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 10.34-1.13.1
10.34-1.13.1
pcre2
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
10.20-110.20-210.20-310.21-110.21-1ubuntu0.1~esm1
 None known
pcre2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
10.22-310.22-410.22-510.22-610.31-210.31-2ubuntu0.1~esm110.31-2ubuntu0.1~esm2
 None known
pcre2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
10.32-510.34-710.34-7ubuntu0.110.34-7ubuntu0.1+esm1
 None known
pcre2
Ubuntu:22.04:LTS
 All versions, plus listed versions
10.37-0ubuntu210.39-310.39-3build110.39-3ubuntu0.110.39-3ubuntu0.2
 None known

History

History
RecordedChangedSources
affected
affectedOSV
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-41409 is a high vulnerability (CVSS 7.5) in Pcre Pcre2, published July 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in pcre2 10.42-r0.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open