Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2022-1587

critical

CVE-2022-1587

pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c

Published Modified CWE 125
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (low).

Description

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

Affected packages and fixed versions

SourcePackageFixed in
CBL-Mariner 1.0pcre20:10.34-2.cm1
alpine 3.13pcre210.36-r1
alpine 3.14pcre210.36-r1
alpine 3.15pcre210.40-r0
alpine 3.16pcre210.40-r0
alpine 3.17pcre210.40-r0
alpine 3.18pcre210.40-r0
alpine 3.19pcre210.40-r0
alpine 3.20pcre210.40-r0
alpine 3.21pcre210.40-r0
alpine 3.22pcre210.40-r0
alpine 3.23pcre210.40-r0
Show all 64 entries from 34 sources
SourcePackageFixed in
CBL-Mariner 1.0pcre20:10.34-2.cm1
alpine 3.13pcre210.36-r1
alpine 3.14pcre210.36-r1
alpine 3.15pcre210.40-r0
alpine 3.16pcre210.40-r0
alpine 3.17pcre210.40-r0
alpine 3.18pcre210.40-r0
alpine 3.19pcre210.40-r0
alpine 3.20pcre210.40-r0
alpine 3.21pcre210.40-r0
alpine 3.22pcre210.40-r0
alpine 3.23pcre210.40-r0
alpine 3.24pcre210.40-r0
alpine edgepcre210.40-r0
amazon linux 2022pcre210.40-1.amzn2022.0.1
amazon linux 2022pcre2-debuginfo10.40-1.amzn2022.0.1
amazon linux 2022pcre2-debugsource10.40-1.amzn2022.0.1
amazon linux 2022pcre2-devel10.40-1.amzn2022.0.1
amazon linux 2022pcre2-static10.40-1.amzn2022.0.1
amazon linux 2022pcre2-syntax10.40-1.amzn2022.0.1
amazon linux 2022pcre2-tools10.40-1.amzn2022.0.1
amazon linux 2022pcre2-tools-debuginfo10.40-1.amzn2022.0.1
amazon linux 2022pcre2-utf1610.40-1.amzn2022.0.1
amazon linux 2022pcre2-utf16-debuginfo10.40-1.amzn2022.0.1
amazon linux 2022pcre2-utf3210.40-1.amzn2022.0.1
amazon linux 2022pcre2-utf32-debuginfo10.40-1.amzn2022.0.1
amazon linux 2023pcre210.40-1.amzn2023.0.2
amazon linux 2023pcre2-debuginfo10.40-1.amzn2023.0.2
amazon linux 2023pcre2-debugsource10.40-1.amzn2023.0.2
amazon linux 2023pcre2-devel10.40-1.amzn2023.0.2
amazon linux 2023pcre2-static10.40-1.amzn2023.0.2
amazon linux 2023pcre2-syntax10.40-1.amzn2023.0.2
amazon linux 2023pcre2-tools10.40-1.amzn2023.0.2
amazon linux 2023pcre2-tools-debuginfo10.40-1.amzn2023.0.2
amazon linux 2023pcre2-utf1610.40-1.amzn2023.0.2
amazon linux 2023pcre2-utf16-debuginfo10.40-1.amzn2023.0.2
amazon linux 2023pcre2-utf3210.40-1.amzn2023.0.2
amazon linux 2023pcre2-utf32-debuginfo10.40-1.amzn2023.0.2
chainguardpcre20
conan::GitLab Advisory Database Communitypcre210.40
debian 10pcre210.32-5+deb10u1
debian 11pcre210.36-2+deb11u1
debian 12pcre210.40-1
debian 13pcre210.40-1
debian 14pcre210.40-1
debian 9pcre2no fix listed
echopcre210.40-1
Oracle Linux 9pcre210.37-5.el9_0
Oracle Linux 9pcre2-devel10.37-5.el9_0
Oracle Linux 9pcre2-syntax10.37-5.el9_0
Oracle Linux 9pcre2-utf1610.37-5.el9_0
Oracle Linux 9pcre2-utf3210.37-5.el9_0
rapidfort Oracle Linux 9pcre20:10.37-5.el9_0
rocky 9pcre210.37-5.el9_0
rocky 9pcre2-devel10.37-5.el9_0
rocky 9pcre2-syntax10.37-5.el9_0
rocky 9pcre2-utf1610.37-5.el9_0
rocky 9pcre2-utf3210.37-5.el9_0
root.io ubuntu 22.04rootio-pcre210.39-3ubuntu0.1
ubuntu 18.04-ESMpcre210.31-2ubuntu0.1~esm1
ubuntu 20.04pcre210.34-7ubuntu0.1
ubuntu 20.04-ESMpcre210.34-7ubuntu0.1
ubuntu 22.04pcre210.39-3ubuntu0.1
wolfipcre20

References

All 23 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.