Re: pcre2 version 10.48 released with security fixes
PCRE2 10.48 ships security fixes; one issue received CVE-2026-86145 while others await identifiers amid CNA backlogs.
Salvatore Bonaccorso noted on oss-security that PCRE2 version 10.48 includes security fixes, with one issue assigned CVE-2026-86145 and remaining fixes not yet assigned identifiers. The post criticizes large CNA backlogs delaying CVE assignment, which complicates downstream fix tracking. No exploitation is reported.
- PCRE2 10.48 released with security fixes
- CVE-2026-86145 assigned to one issue
- Other fixes lack CVE identifiers so far
- CNA backlogs delay identifier assignment
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86145 | Out-of-Bounds Write in PCRE2 Regular Expression Library (pcre2_dfa_match) | 8.2 | <1% |
From the original article
Posted by Salvatore Bonaccorso on Sep 05 Hi, [...] This one got CVE-2026-86145, but so far not the others I think. For tracking downstream fixes defintively it would be more helpful to have a CVE identifier assigned sooner, but right now as we know many of the CNAs in scope for products have huge backlogs.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.