Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Hello, I'd like to offer a backport of the CVE-2026-86145 fix (GHSA-3r4p-g7gg-ppmf) for the stable releases. Fedora 43, 44 and 45 all ship PCRE2 10.47, which is affected; upstream fixed it in 10.48, and the Rawhide rebase to 10.49 in PR 36 already includes the fix: https://src.fedoraproject.org/rpms/pcre2/pull-request/36 The bug is in DFA matching (pcre2_dfa_match() only; pcre2_match() and JIT are not affected). A crafted pattern that combines nested assertions and recursion with a low heap limit, which the pattern itself can set with (*LIMIT_HEAP=...), makes a later recursion reuse a cached workspace block that is too small. The result is a heap out-of-bounds write, so any application that runs untrusted patterns through pcre2_dfa_match() can at least be crashed. The attached patch is upstream commit c932e70451ea, unchanged (upstream also applied it to its 10.47 release branch). It checks the size of a reused workspace block, makes the heap-limit clamp overflow-safe, adds assertions at the recursion sites, and adds the upstream regression test to testinput6, so it runs during %check. The patch applies cleanly, without fuzz, to the current f43 and f44 sources. F45 has the same tarball and patches, so it should apply there too, but I have not checked that branch separately. On a Fedora 44 source build, the upstream test crashed without the patch and returned the expected "heap limit exceeded" error with it. I have not done a Mock or full RPM build. AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Could you consider it for the f43/f44 (and f45, if appropriate) updates? I'm happy to fit it into whatever you have planned alongside the Rawhide rebase. Thanks!
Created attachment 2161371 [details] upstream patch
Hi there Artem, Thanks for looking into this. I am planning to rebase in stable as well, I was verifying ABI/API changes between the 10.47 and 10.49 pcre2 releases before doing so, as a lot of packages require and build require this package. I believe there should not be much of an issue and if all goes well we will not need to backport patches at all. Regards, Daniel
FEDORA-2026-450395b11f (pcre2-10.49-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-450395b11f
FEDORA-2026-3dc7e56d1e (pcre2-10.49-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3dc7e56d1e
FEDORA-2026-450395b11f has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-450395b11f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-450395b11f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-3dc7e56d1e has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3dc7e56d1e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3dc7e56d1e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.