CVE-2026-89162
Fixed in a distro release EPSS <1%CVSS 2.9
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
Products: pcre2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.22 | pcre2 | 10.46-r1 |
| Alpine 3.23 | pcre2 | 10.48-r0 |
| Alpine 3.24 | pcre2 | 10.48-r0 |
| Debian 13 | pcre2 | 10.46-1~deb13u2 |
| Debian 14 | pcre2 | 10.48-1 |
| Red Hat hummingbird 1 | pcre2 | 0:10.48-0.1.hum1 |
| Red Hat hummingbird 1 | pcre2-devel | 0:10.48-0.1.hum1 |
| Red Hat hummingbird 1 | pcre2-static | 0:10.48-0.1.hum1 |
| Red Hat hummingbird 1 | pcre2-syntax | 0:10.48-0.1.hum1 |
| Red Hat hummingbird 1 | pcre2-tools | 0:10.48-0.1.hum1 |
| Red Hat hummingbird 1 | pcre2-utf16 | 0:10.48-0.1.hum1 |
| Red Hat hummingbird 1 | pcre2-utf32 | 0:10.48-0.1.hum1 |
| SUSE Linux Enterprise Server 16.0 | pcre2 | 10.45-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | pcre2 | 10.45-160000.4.1 |
| SUSE Linux Micro 6.2 | pcre2 | 10.45-160000.4.1 |
| Ubuntu 26.04 LTS | pcre2 | no fix |
| Ubuntu 26.10 | pcre2 | no fix |
| openSUSE Leap 16.0 | pcre2 | 10.45-160000.4.1 |