Threats affecting pkg:github/pcre2project/pcre2

CVE-2026-103111 is a high-severity vulnerability in PCRE2 versions before 10.49. It involves an out-of-bounds write triggered by attacker-controlled regular expressions combined with specific JIT API usage. This flaw can lead to arbitrary data being written out-of-bounds, affecting integrity and potentially availability.

CVE-2026-89162 is a medium severity vulnerability in PCRE2 versions 10.45 up to but not including 10.48. It involves an incorrect resource transfer issue in the pcre2_serialize_encode function that may disclose two bytes of information to an adversary. This typically occurs in scenarios where the adversary already has unsafe access. The vulnerability does not affect integrity or availability and requires local access with high attack complexity.

CVE-2026-89161 is a high-severity vulnerability in PCRE2 versions before 10.48 where the function pcre2_jit_match improperly frees memory that was not allocated on the heap. This incorrect free operation can lead to serious impacts including confidentiality, integrity, and availability violations.

CVE-2026-89160 is an out-of-bounds read vulnerability in PCRE2 versions from 10.34 up to but not including 10.48. It occurs during the PCRE2_MATCH_INVALID_UTF matching process when handling an invalid UTF subject. The vulnerability has a medium severity with a CVSS score of 3.7 and does not impact confidentiality or integrity but may affect availability.

CVE-2026-89158 is an integer overflow vulnerability in PCRE2 versions before 10.48 on 32-bit platforms. The flaw exists in the pcre2_compile_32 function, leading to an integer overflow and a subsequent out-of-bounds write. This vulnerability can cause integrity issues and limited availability impact but does not affect confidentiality.

CVE-2026-89157 is an integer overflow or wraparound vulnerability in PCRE2 versions 10.30 up to but not including 10.48 on 32-bit platforms. It occurs in the pcre2_pattern_convert function when processing a large pattern, leading to an out-of-bounds write. This vulnerability has a medium severity with a CVSS score of 5.7 and impacts the integrity and availability of affected systems.

CVE-2026-89156 is an out-of-bounds read vulnerability in the PCRE2 library's pcre2_match function triggered after a JIT fallback when invalid UTF data is provided. PCRE2 is a C library for regular expression matching with separate 8-bit, 16-bit, and 32-bit APIs. This vulnerability affects versions from 10.34 up to but not including 10.48. The CVSS score is 2.9, indicating low severity for this specific issue. Multiple related vulnerabilities in PCRE2 before 10.48 address out-of-bounds reads and writes, integer overflows, and incorrect memory frees. The vendor has fixed these issues in version 10.48.