critical
CVE-2022-1586
pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner. Rated lower by Red Hat (medium), AlmaLinux (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (low).
Description
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | pcre2 | 0:10.34-2.cm1 |
| alma 8 | pcre2, pcre2-devel, pcre2-tools and 2 more | 10.32-3.el8_6 |
| alpine 3.13 | pcre2 | 10.36-r1 |
| alpine 3.14 | pcre2 | 10.36-r1 |
| alpine 3.15 | pcre2 | 10.40-r0 |
| alpine 3.16 | pcre2 | 10.40-r0 |
| alpine 3.17 | pcre2 | 10.40-r0 |
| alpine 3.18 | pcre2 | 10.40-r0 |
| alpine 3.19 | pcre2 | 10.40-r0 |
| alpine 3.20 | pcre2 | 10.40-r0 |
| alpine 3.21 | pcre2 | 10.40-r0 |
| alpine 3.22 | pcre2 | 10.40-r0 |
Show all 85 entries from 38 sources
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | pcre2 | 0:10.34-2.cm1 |
| alma 8 | pcre2 | 10.32-3.el8_6 |
| alma 8 | pcre2-devel | 10.32-3.el8_6 |
| alma 8 | pcre2-tools | 10.32-3.el8_6 |
| alma 8 | pcre2-utf16 | 10.32-3.el8_6 |
| alma 8 | pcre2-utf32 | 10.32-3.el8_6 |
| alpine 3.13 | pcre2 | 10.36-r1 |
| alpine 3.14 | pcre2 | 10.36-r1 |
| alpine 3.15 | pcre2 | 10.40-r0 |
| alpine 3.16 | pcre2 | 10.40-r0 |
| alpine 3.17 | pcre2 | 10.40-r0 |
| alpine 3.18 | pcre2 | 10.40-r0 |
| alpine 3.19 | pcre2 | 10.40-r0 |
| alpine 3.20 | pcre2 | 10.40-r0 |
| alpine 3.21 | pcre2 | 10.40-r0 |
| alpine 3.22 | pcre2 | 10.40-r0 |
| alpine 3.23 | pcre2 | 10.40-r0 |
| alpine 3.24 | pcre2 | 10.40-r0 |
| alpine edge | pcre2 | 10.40-r0 |
| amazon linux 2 | pcre2 | 10.23-11.amzn2.0.1 |
| amazon linux 2 | pcre2-debuginfo | 10.23-11.amzn2.0.1 |
| amazon linux 2 | pcre2-devel | 10.23-11.amzn2.0.1 |
| amazon linux 2 | pcre2-static | 10.23-11.amzn2.0.1 |
| amazon linux 2 | pcre2-tools | 10.23-11.amzn2.0.1 |
| amazon linux 2 | pcre2-utf16 | 10.23-11.amzn2.0.1 |
| amazon linux 2 | pcre2-utf32 | 10.23-11.amzn2.0.1 |
| amazon linux 2022 | pcre2 | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-debugsource | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-devel | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-static | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-syntax | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-tools | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-tools-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf16 | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf16-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf32 | 10.40-1.amzn2022.0.1 |
| amazon linux 2022 | pcre2-utf32-debuginfo | 10.40-1.amzn2022.0.1 |
| amazon linux 2023 | pcre2 | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-debuginfo | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-debugsource | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-devel | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-static | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-syntax | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-tools | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-tools-debuginfo | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf16 | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf16-debuginfo | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf32 | 10.40-1.amzn2023.0.2 |
| amazon linux 2023 | pcre2-utf32-debuginfo | 10.40-1.amzn2023.0.2 |
| chainguard | pcre2 | 0 |
| conan::GitLab Advisory Database Community | pcre2 | 10.40 |
| debian 10 | pcre2 | 10.32-5+deb10u1 |
| debian 11 | pcre2 | 10.36-2+deb11u1 |
| debian 12 | pcre2 | 10.40-1 |
| debian 13 | pcre2 | 10.40-1 |
| debian 14 | pcre2 | 10.40-1 |
| debian 9 | pcre2 | no fix listed |
| echo | pcre2 | 10.40-1 |
| Oracle Linux 8 | pcre2 | 10.32-3.el8_6 |
| Oracle Linux 8 | pcre2-devel | 10.32-3.el8_6 |
| Oracle Linux 8 | pcre2-tools | 10.32-3.el8_6 |
| Oracle Linux 8 | pcre2-utf16 | 10.32-3.el8_6 |
| Oracle Linux 8 | pcre2-utf32 | 10.32-3.el8_6 |
| Oracle Linux 9 | pcre2 | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-devel | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-syntax | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-utf16 | 10.37-5.el9_0 |
| Oracle Linux 9 | pcre2-utf32 | 10.37-5.el9_0 |
| rapidfort Oracle Linux 9 | pcre2 | 0:10.37-5.el9_0 |
| rocky 8 | pcre2 | 10.32-3.el8_6 |
| rocky 8 | pcre2-devel | 10.32-3.el8_6 |
| rocky 8 | pcre2-utf16 | 10.32-3.el8_6 |
| rocky 8 | pcre2-utf32 | 10.32-3.el8_6 |
| rocky 9 | pcre2 | 10.37-5.el9_0 |
| rocky 9 | pcre2-devel | 10.37-5.el9_0 |
| rocky 9 | pcre2-syntax | 10.37-5.el9_0 |
| rocky 9 | pcre2-utf16 | 10.37-5.el9_0 |
| rocky 9 | pcre2-utf32 | 10.37-5.el9_0 |
| root.io ubuntu 22.04 | rootio-pcre2 | 10.39-3ubuntu0.1 |
| ubuntu 18.04-ESM | pcre2 | 10.31-2ubuntu0.1~esm1 |
| ubuntu 20.04 | pcre2 | 10.34-7ubuntu0.1 |
| ubuntu 20.04-ESM | pcre2 | 10.34-7ubuntu0.1 |
| ubuntu 22.04 | pcre2 | 10.39-3ubuntu0.1 |
| wolfi | pcre2 | 0 |
References
- https://access.redhat.com/errata/RHSA-2022:5251
- https://access.redhat.com/errata/RHSA-2022:5809
- https://access.redhat.com/security/cve/CVE-2022-1586
- https://bugzilla.redhat.com/2077976
- https://bugzilla.redhat.com/show_bug.cgi?id=2077976
- https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C
- https://bugzilla.redhat.com/show_bug.cgi?id=2077976,
- https://bugzilla.redhat.com/show_bug.cgi?id=2077983
All 28 references
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1586
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1587
- https://errata.almalinux.org/8/ALSA-2022-5809.html
- https://errata.rockylinux.org/RLSA-2022:5251
- https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a
- https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C
- https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c
- https://linux.oracle.com/cve/CVE-2022-1586.html
- https://linux.oracle.com/errata/ELSA-2022-5809.html
- https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1586
- https://security.netapp.com/advisory/ntap-20221028-0009/
- https://ubuntu.com/security/notices/USN-5627-1
- https://ubuntu.com/security/notices/USN-5627-2
- https://www.cve.org/CVERecord?id=CVE-2022-1586