Known Vulnerabilities for products from PCRE
Listed below are 20 of the newest known vulnerabilities associated with the vendor "PCRE".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-102601 json | Not Provided | 2026-09-29 | 2026-09-29 | |
| CVE-2026-89162 json | In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the ac... | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-89161 json | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free... | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-89160 json | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject... | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-89158 json | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-89157 json | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large... | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-89156 json | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-75834 json | Not Provided | 2026-08-18 | 2026-08-18 | |
| CVE-2026-67413 json | Not Provided | 2026-09-25 | 2026-09-29 | |
| CVE-2026-62237 json | Not Provided | 2026-07-17 | 2026-07-21 | |
| CVE-2026-57584 json | Not Provided | 2026-07-10 | 2026-07-13 | |
| CVE-2026-42945 json | Not Provided | 2026-05-13 | 2026-09-10 | |
| CVE-2026-9256 json | Not Provided | 2026-05-22 | 2026-08-25 | |
| CVE-2022-41409 json | Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified i... | 7.5 - HIGH | 2023-07-18 | 2023-07-27 |
| CVE-2022-1587 json | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre... | 9.1 - CRITICAL | 2022-05-16 | 2023-11-07 |
| CVE-2022-1586 json | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the ... | 9.1 - CRITICAL | 2022-05-16 | 2023-11-07 |
| CVE-2020-14155 json | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. | 5.3 - MEDIUM | 2020-06-15 | 2024-03-27 |
| CVE-2019-20838 json | libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fix... | 7.5 - HIGH | 2020-06-15 | 2024-03-27 |
| CVE-2019-20454 json | An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially cra... | 7.5 - HIGH | 2020-02-14 | 2024-03-27 |
| CVE-2017-16231 json | ** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in p... | 5.5 - MEDIUM | 2019-03-21 | 2023-11-07 |
Known software with vulnerabilities from PCRE
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Pcre | Libpcre | 8.44 |
| Application | Pcre | Pcre | 1.00 |
| Application | Pcre | Pcre2 | 10.00 |
| Application | Pcre | Perl-compatible Regular Expression Library | 7.0 |
| Application | Pcre | Perl Compatible Regular Expression Library | 8.36 |