Story · 1 source · 1 articlefirst Sep 4, 23:27 UTCupdated Sep 4, 23:27 UTC (11d ago)

PCRE2 10.48 released with security fixes; one issue assigned CVE-2026-86145

lowVulnerabilityimportance 30CVE-2026-86145

What's new: Between the two reports: (1) one issue in PCRE2 10.48 was assigned CVE-2026-86145, whereas the initial 2026-09-04 announcement reported no CVE identifiers; (2) the follow-up added context that CNA backlogs are delaying identifier assignment for the remaining fixes.

Merged summary · glm-5.3-flash · rewritten as coverage arrives

PCRE2 10.48 shipped with multiple security fixes, announced on oss-security on 2026-09-04. One issue has since been assigned CVE-2026-86145; the remaining fixes await CVE identifiers amid reported CNA backlogs. No exploitation is reported.

The PCRE2 project released version 10.48 including security fixes, announced by Alan Coopersmith on the oss-security mailing list on 2026-09-04 (2026-09-04T23:27:48Z). At that time, none of the fixes had CVE identifiers assigned, and specifics were available only via the project's release notes, specifically the 10.48 NEWS file and the security advisories page. In a follow-up post on 2026-09-05 (2026-09-05T12:14:26Z), Salvatore Bonaccorso reported that one of the fixed issues has been assigned CVE-2026-86145, while the remaining fixes still lack identifiers. The follow-up criticized large CNA backlogs that delay CVE assignment and complicate downstream fix tracking. No exploitation is reported. Per the wire policy, sources do not contradict each other: the first report reflects the state at publication and the second reflects a later update in identifier assignment.

PCRE2 version 10.48 was released with security fixes, announced on the oss-security mailing list by Alan Coopersmith on 2026-09-04 (2026-09-04T23:27:48Z).
CVE-2026-86145 has been assigned to one of the fixed issues, per Salvatore Bonaccorso's follow-up on oss-security dated 2026-09-05 (2026-09-05T12:14:26Z).
At the time of the initial announcement (2026-09-04), none of the fixes had CVE identifiers assigned; after the follow-up (2026-09-05), the remaining fixes still lack identifiers.
Follow-up discussion attributes the delay in identifier assignment to large CNA backlogs, which complicates downstream fix tracking.
Details of the fixes are limited to the project's 10.48 NEWS file (release notes) and security advisories page; no exploitation is reported.
No exploit code is provided in the sources.

VendorsPCRE2 PCRE2 Project

ProductsPCRE2

OrganizationsPCRE2 Project

Coverage timelineoldest first · each row is one article

Sep 4, 23:27 UTC · 11d ago
oss-security· 20
pcre2 version 10.48 released with security fixes
PCRE2 10.48 released with security fixes; none have CVE IDs assigned yet, details limited to release notes.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-86145	Out-of-Bounds Write in PCRE2 Regular Expression Library (pcre2_dfa_match) PCRE2, the widely embedded Perl-compatible regular expression library, contains an out-of-bounds write in its pcre2_dfa_match function because the code path that reuses a cached workspace block skips the size check that a newly allocated block performs. Triggering the flaw requires either an attacker-controlled regular expression or a recursive pattern combined with a small heap limit set through the API, conditions that arise in applications that let users supply regex patterns or tune PCRE2's heap limit. A successful attacker can write beyond the workspace buffer, corrupting data (high integrity impact per CVSS 3.1) with only low availability impact; code execution is not documented. Any application, service, or language runtime bundling PCRE2 before 10.48 is affected, with real-world exposure concentrated in software that passes user-controlled regexes to the library. No public proof-of-concept or in-the-wild exploitation is known, EPSS puts the 30-day exploitation probability at 0.4%, and the flaw is fixed in PCRE2 10.48. Do: Upgrade PCRE2 to 10.48 or later, and install vendor updates (new PHP packages, distribution packages, or application releases) that bundle the fixed library. Audit whether your applications expose user-supplied regular expressions or call pcre2 APIs with recursive patterns and a reduced heap limit, and restrict or validate such inputs until patched. No public PoC or in-the-wild exploitation is known, so no emergency action is required beyond normal patching.	8.2	<1%		PCRE2 project PCRE2 All versions before 10.48 (fixed in 10.48)	mass≈millions of installations of software bundling PCRE2 (e.g., PHP, Apache HTTP Server); the directly exploitable subset is unknown	11d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-86145

Out-of-Bounds Write in PCRE2 Regular Expression Library (pcre2_dfa_match)

PCRE2, the widely embedded Perl-compatible regular expression library, contains an out-of-bounds write in its pcre2_dfa_match function because the code path that reuses a cached workspace block skips the size check that a newly allocated block performs. Triggering the flaw requires either an attacker-controlled regular expression or a recursive pattern combined with a small heap limit set through the API, conditions that arise in applications that let users supply regex patterns or tune PCRE2's heap limit. A successful attacker can write beyond the workspace buffer, corrupting data (high integrity impact per CVSS 3.1) with only low availability impact; code execution is not documented. Any application, service, or language runtime bundling PCRE2 before 10.48 is affected, with real-world exposure concentrated in software that passes user-controlled regexes to the library. No public proof-of-concept or in-the-wild exploitation is known, EPSS puts the 30-day exploitation probability at 0.4%, and the flaw is fixed in PCRE2 10.48.

Do: Upgrade PCRE2 to 10.48 or later, and install vendor updates (new PHP packages, distribution packages, or application releases) that bundle the fixed library. Audit whether your applications expose user-supplied regular expressions or call pcre2 APIs with recursive patterns and a reduced heap limit, and restrict or validate such inputs until patched. No public PoC or in-the-wild exploitation is known, so no emergency action is required beyond normal patching.

8.2

<1%

PCRE2 project PCRE2 All versions before 10.48 (fixed in 10.48)

mass≈millions of installations of software bundling PCRE2 (e.g., PHP, Apache HTTP Server); the directly exploitable subset is unknown

11d ago