|
pcre2 (10.42-4ubuntu2.2) noble-security; urgency=medium
* SECURITY UPDATE: Fix large JIT stack allocation.
- src/pcre2_jit_compile.c: Track oversized stack allocations and compute
the growth threshold from the stack top instead of assuming the stack
starts near its base, preventing an out-of-bounds write.
- Authors: Zoltan Herczeg, Nicholas Wilson
- 2b4038298072684b0fae29b15bedfb1a75bda46d
- 6f9d7c1373262c541324a16a358785b33ef116cf
- CVE-2026-103111
* SECURITY UPDATE: Fix DFA workspace overflows
- src/pcre2_dfa_match.c: Size new workspace blocks to fit the current
ovector request and stop reusing a next block that is too small,
preventing workspace overflow past the heap limit.
- testdata/testinput6, testdata/testoutput6: Regression tests for the
workspace overflow cases.
- Author: Nicholas Wilson
- c932e70451eafef922ebef364ac25042f0031135
- CVE-2026-86145
* SECURITY UPDATE: Fix pcre2_match to check for JIT support before JIT
validation & execution
- src/pcre2_internal.h: Declare the new jit_check_exec() helper.
- src/pcre2_jit_misc.c: Add jit_check_exec() to verify the requested
matching mode is compiled in before running JIT code.
- src/pcre2_match.c: Gate the JIT fast path on jit_check_exec() so a
missing JIT mode falls through to the interpreter's own UTF validation
instead of skipping it.
- Author: Zoltan Herczeg
- f67db227af31bba7cdf2a7a00b97af91b588c2f5
- CVE-2026-89156
* SECURITY UPDATE: Use CU2BYTES for byte sizing in two allocation sites
- src/pcre2_convert.c, src/pcre2_substring.c: Size allocations with
CU2BYTES() instead of multiplying by PCRE2_CODE_UNIT_WIDTH, and reject
lengths that would overflow the size calculation.
- Author: Ilia Alshanetsky
- 8156b3989a82f2ddf9504d8248496e9b124be7f3
- CVE-2026-89157
* SECURITY UPDATE: Fix compiler integer overflows
- src/pcre2_compile.c: Guard pattern length accumulation against
OFLOW_MAX and MAX_PATTERN_SIZE overflow.
- Author: Nicholas Wilson
- ec9c286d5c10cf1c388b58a442ccefded42254fd
- CVE-2026-89158
* SECURITY UPDATE: Fix invalid UTF backwards-scan reads
- src/pcre2_extuni.c, src/pcre2_match.c: Bound backwards scans at
check_subject rather than start_subject so they cannot read into an
invalid UTF prefix before it has been validated.
- testdata/testinput10, testdata/testoutput10, testdata/testinput12,
testdata/testoutput12-16, testdata/testoutput12-32: Regression tests
for backwards scans over invalid UTF prefixes.
- Author: Nicholas Wilson
- 4889caf31a4c5a6b3c051f0031bf2dbd78f2c287
- CVE-2026-89160
* SECURITY UPDATE: Fix leak & stale PCRE2_MD_COPIED_SUBJECT if
pcre2_jit_match used with existing match context.
- src/pcre2_jit_match.c: Free a previously copied subject and clear the
PCRE2_MD_COPIED_SUBJECT flag before reusing a match data block.
- src/pcre2test.c: Detect a wrongly-set or wrongly-cleared copied-subject
state after a JIT match.
- testdata/testinput17, testdata/testoutput17: Test the copied-subject
handling on the JIT fast path.
- Author: Nicholas Wilson
- 1dcd0cf42a6a7cb62cc9a7c024196733abcfda95
- CVE-2026-89161
-- Kyle Kernick Thu, 15 Oct 2026 16:21:33 -0600
|
| CVE-2026-103111 |
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary d |
| CVE-2026-86145 |
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lac |
| CVE-2026-89156 |
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. |
| CVE-2026-89157 |
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. |
| CVE-2026-89158 |
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. |
| CVE-2026-89160 |
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. |
| CVE-2026-89161 |
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. |
|
