{"id":"CVE-2026-89162","aliases":["ALPINE-CVE-2026-89162","BELL-CVE-2026-89162","DEBIAN-CVE-2026-89162","EUVD-2026-75947","GHSA-mv4q-849q-vg78","GHSA-q7rw-r7qq-2hx6","RHSA-2026:67534","SUSE-SU-2026:23891-1","SUSE-SU-2026:23906-1","UBUNTU-CVE-2026-89162","USN-8974-1","openSUSE-SU-2026:21938-1"],"status":"published","title":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically...","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00156,"percentile":0.04757,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-669"],"published":"2026-09-11T04:15:04Z","modified":"2026-11-04T03:43:07Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"pcre2","fixed_in":["10.46-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pcre2","fixed_in":["10.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pcre2","fixed_in":["10.48-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"pcre2","fixed_in":["10.48-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"pcre2","fixed_in":["10.48-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"pcre2","fixed_in":["10.48-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"pcre2","fixed_in":["10.48-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pcre2","fixed_in":["10.46-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pcre2","fixed_in":["10.48-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"pcre2","fixed_in":["10.46-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pcre2","fixed_in":["10.46-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.45"},{"fixed":"10.46-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.45"},{"fixed":"10.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.45"},{"fixed":"10.48-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.43-r1"},{"fixed":"10.48-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.40-r1"},{"fixed":"10.48-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.43-r1"},{"fixed":"10.48-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.40-r1"},{"fixed":"10.48-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.46-1~deb13u2"}]}],"versions":["10.45-1","10.46-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.48-1"}]}],"versions":["10.45-1","10.46-1","10.46-1~deb13u1","10.46-1~deb13u2","10.46-1~deb13u3","10.47-1","10.47-2"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2-syntax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2-utf16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"pcre2-utf32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.48-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.45-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.45-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.45-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.46-1ubuntu1"}]}],"versions":["10.46-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.46-1ubuntu0.1"}]}],"versions":["10.46-1","10.46-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21-1ubuntu0.1~esm1"}]}],"versions":["10.20-1","10.20-2","10.20-3","10.21-1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.31-2ubuntu0.1~esm2"}]}],"versions":["10.22-3","10.22-4","10.22-5","10.22-6","10.31-2","10.31-2ubuntu0.1~esm1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.34-7ubuntu0.1+esm1"}]}],"versions":["10.32-5","10.34-7","10.34-7ubuntu0.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.39-3ubuntu0.2"}]}],"versions":["10.37-0ubuntu2","10.39-3","10.39-3build1","10.39-3ubuntu0.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.42-4ubuntu2.2"}]}],"versions":["10.42-4","10.42-4ubuntu1","10.42-4ubuntu2","10.42-4ubuntu2.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.46-1ubuntu1"}]}],"versions":["10.46-1build1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.46-1ubuntu0.1"}]}],"versions":["10.46-1","10.46-1build1"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"pcre2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.45-160000.4.1"}]}],"bundled":7}],"products":[{"vendor":"pcre","product":"pcre2"},{"vendor":"pcre2project","product":"pcre2"}],"references":[{"url":"https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","tags":["Release Notes","web","article","report"]},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6","tags":["Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89162","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mv4q-849q-vg78"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-89162","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-89162","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89162.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-89162","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67534","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89161","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89160","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89158","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89157","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89156","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89162","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86145","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67534.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","tags":["advisory"]},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531743","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","tags":["advisory"]},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531744","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","tags":["advisory"]},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","tags":["advisory"]},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531745","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","tags":["advisory"]},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","tags":["advisory"]},{"url":"https://github.com/PCRE2Project/pcre2/pull/937","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531748","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89162","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623891-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277707","tags":["report"]},{"url":"https://bugzilla.suse.com/1277708","tags":["report"]},{"url":"https://bugzilla.suse.com/1277709","tags":["report"]},{"url":"https://bugzilla.suse.com/1277710","tags":["report"]},{"url":"https://bugzilla.suse.com/1277711","tags":["report"]},{"url":"https://bugzilla.suse.com/1277712","tags":["report"]},{"url":"https://bugzilla.suse.com/1277713","tags":["report"]},{"url":"https://bugzilla.suse.com/1279893","tags":["report"]},{"url":"https://bugzilla.suse.com/1280049","tags":["report"]},{"url":"https://bugzilla.suse.com/1280050","tags":["report"]},{"url":"https://bugzilla.suse.com/1280051","tags":["report"]},{"url":"https://bugzilla.suse.com/1280052","tags":["report"]},{"url":"https://bugzilla.suse.com/1280053","tags":["report"]},{"url":"https://bugzilla.suse.com/1280054","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89162","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623906-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-89162","tags":["report"]},{"url":"https://github.com/PCRE2Project/pcre2/commit/edc111a6831591f68b5355a08cc9df8be8f35304","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8974-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-86145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-103111","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T04:15:04.246Z","modified":"2026-09-14T18:18:12.242Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:19:55.176387Z"}],"euvd":[{"id":"EUVD-2026-75947","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T04:15:04Z","modified":"2026-09-14T18:18:12Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:19.730872Z"}],"ghsa":[{"id":"GHSA-mv4q-849q-vg78","title":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically...","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T06:31:14Z","modified":"2026-09-11T06:31:21Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:11:44.427999Z"}],"nvd":[{"id":"CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T05:16:38.697Z","modified":"2026-09-16T18:56:28.643Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"ALPINE-CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T05:16:38.697Z","modified":"2026-10-21T05:30:02.538582441Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-89162","status":"published","published":"2026-09-13T06:04:29.376498Z","modified":"2026-10-01T07:15:05.359396999Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T04:15:04.246Z","modified":"2026-10-28T02:31:00.248752608Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T05:16:38.697Z","modified":"2026-10-01T03:03:52.235313673Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"RHSA-2026:67534","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:18:41Z","modified":"2026-10-20T10:13:58Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","status":"published","published":"2026-09-11T05:16:00Z","modified":"2026-11-04T03:30:33.828710225Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-04T03:56:39.110241Z"},{"id":"openSUSE-SU-2026:21938-1","title":"Security update for pcre2","description":"This update for pcre2 fixes the following issues:\n\n- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).\n- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).\n- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).\n- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).\n- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject\n  (bsc#1280051).\n- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`\n  (bsc#1280050).\n- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).\n","status":"published","published":"2026-09-23T19:41:55Z","modified":"2026-09-25T18:23:14.236213502Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23891-1","title":"Security update for pcre2","description":"This update for pcre2 fixes the following issues:\n\n- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).\n- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).\n- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).\n- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).\n- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject\n  (bsc#1280051).\n- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`\n  (bsc#1280050).\n- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).\n","status":"published","published":"2026-09-23T19:42:24Z","modified":"2026-09-30T18:23:11.240450066Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23906-1","title":"Security update for pcre2","description":"This update for pcre2 fixes the following issues:\n\n- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).\n- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).\n- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).\n- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).\n- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject\n  (bsc#1280051).\n- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`\n  (bsc#1280050).\n- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).\n","status":"published","published":"2026-09-23T19:42:24Z","modified":"2026-09-30T18:23:12.229789994Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"USN-8974-1","title":"pcre2 vulnerabilities","description":"It was discovered that PCRE2 did not correctly manage memory when\nprocessing certain patterns. An attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-86145)\n\nAlbert Zhang discovered that PCRE2 did not correctly process certain\ninput. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89156)\n\nIt was discovered that PCRE2 did not correctly handle large patterns. On\n32-bit platforms, an attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu\n26.10. (CVE-2026-89157)\n\nIt was discovered that PCRE2 did not correctly handle certain patterns.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-89158)\n\nIlia Alshanetsky discovered that PCRE2 did not correctly handle certain\ninput. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89160)\n\nIt was discovered that PCRE2 did not correctly manage memory when handling\ncertain patterns. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-89161)\n\nIt was discovered that PCRE2 could expose uninitialized data in certain\ncircumstances. A local attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 26.04 LTS and\nUbuntu 26.10. (CVE-2026-89162)\n\nMichael Allen discovered that PCRE2 did not correctly manage memory when\nusing just-in-time compilation. An attacker could possibly use this issue\nto execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. (CVE-2026-103111)","status":"published","published":"2026-11-03T15:46:30Z","modified":"2026-11-04T03:43:07.973928197Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}