CVE-2025-58050
pcre2: PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Julia (medium), Ubuntu (medium).
Description
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.22 | pcre2 | 10.46-r0 |
| alpine 3.23 | pcre2 | 10.46-r0 |
| alpine 3.24 | pcre2 | 10.46-r0 |
| alpine edge | pcre2 | 10.46-r0 |
| debian 13 | pcre2 | 10.46-1~deb13u1 |
| debian 14 | pcre2 | 10.46-1 |
| julia::Julia Ecosystem Security Advisories | PCRE2_jll | 10.46.0+0 |
| minimos | pcre2 | 10.46-r0 |
| rapidfort alpine 3.20 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.21 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.22 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.23 | pcre2 | 10.46-r0 |
Show all 20 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.22 | pcre2 | 10.46-r0 |
| alpine 3.23 | pcre2 | 10.46-r0 |
| alpine 3.24 | pcre2 | 10.46-r0 |
| alpine edge | pcre2 | 10.46-r0 |
| debian 13 | pcre2 | 10.46-1~deb13u1 |
| debian 14 | pcre2 | 10.46-1 |
| julia::Julia Ecosystem Security Advisories | PCRE2_jll | 10.46.0+0 |
| minimos | pcre2 | 10.46-r0 |
| rapidfort alpine 3.20 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.21 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.22 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.23 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.24 | pcre2 | 10.46-r0 |
| rapidfort debian 12 | pcre2 | 0:10.46-1, 0:10.46-1~deb13u1 |
| rapidfort debian 12 | rf-pcre2 | 0:10.46-1~deb13u1 |
| rapidfort debian 13 | pcre2 | 0:10.46-1, 0:10.46-1~deb13u1 |
| rapidfort debian 13 | rf-pcre2 | 0:10.46-1~deb13u1 |
| root.io ubuntu 22.04 | pcre2 | 10.39-3ubuntu0.1.root.io.1, 10.39-3ubuntu0.1.root.io.2, 10.39-3ubuntu0.1.root.io.3, 10.39-3ubuntu0.1.root.io.4 |
| root.io ubuntu 22.04 | rootio-pcre2 | 10.39-3ubuntu0.1.root.io.1, 10.39-3ubuntu0.1.root.io.2, 10.39-3ubuntu0.1.root.io.3, 10.39-3ubuntu0.1.root.io.4 |
| ubuntu 25.04 | pcre2 | 10.45-1ubuntu0.1 |
References
- https://access.redhat.com/security/cve/CVE-2025-58050
- https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.46
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
- https://nvd.nist.gov/vuln/detail/CVE-2025-58050
- https://ubuntu.com/security/notices/USN-7777-1
- https://www.cve.org/CVERecord?id=CVE-2025-58050