Pcre

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Pcre product.

RSS Feeds for Pcre security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Pcre products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Pcre Sorted by Most Security Vulnerabilities since 2018

Pcre16 vulnerabilities

Pcre212 vulnerabilities

Pcre Perl Compatible Regular Expression Library7 vulnerabilities

By the Year

In 2026 there have been 7 vulnerabilities in Pcre with an average score of 5.3 out of ten. Pcre did not have any published security vulnerabilities last year. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	7	5.33
2025	0	0.00
2024	0	0.00
2023	1	7.50
2022	2	9.10
2021	0	0.00
2020	5	6.65
2019	1	5.50

It may take a day or so for new Pcre vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Pcre Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-89162	Sep 11, 2026	PCRE2 <10.48: pcre2_serialize_encode 2-byte disclosure In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.	Pcre2
CVE-2026-89161	Sep 11, 2026	PCRE2 10.48 pcre2_jit_match Incorrect Free Vulnerability In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.	Pcre2
CVE-2026-89160	Sep 11, 2026	PCRE2 <10.48 OOB Read in pcre2_match during PCRE2_MATCH_INVALID_UTF PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.	Pcre2
CVE-2026-89158	Sep 11, 2026	Integer Overflow in PCRE2 <=10.48 pcre2_compile_32 (32Bit) PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.	Pcre2
CVE-2026-89157	Sep 11, 2026	PCRE2 <10.48 \| pcre2_pattern_convert OOB Write on 32-bit PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.	Pcre2
CVE-2026-89156	Sep 11, 2026	PCRE2 <10.48 OOB Read via JIT Fallback on Invalid UTF PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.	Pcre2
CVE-2026-86145	Sep 05, 2026	PCRE2 <10.48 DFA OOB Write via pcre2_dfa_match Cache Reuse PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).	Pcre2
CVE-2022-41409	Jul 18, 2023	PCRE2: Integer Overflow in pcre2test (pre10.41) -> DoS Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.	Pcre2
CVE-2022-1586	May 16, 2022	An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.	Pcre2
CVE-2022-1587	May 16, 2022	An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.	Pcre2