An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the…

Description

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

Scores

EPSS (exploitation in 30 days)

2.8% · top 14% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Weakness

• CWE-125 - Out-of-bounds Read (opens in a new tab)All about CWE-125 and its CVEs

Affected products

• pcre2

  • affected Fixed in pcre2-10.40.

References (8)

• FEDORA-2022-e56085ba31 (opens in a new tab)vendor-advisoryx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C (opens in a new tab)x_transferred
• https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0 (opens in a new tab)x_transferred
• FEDORA-2022-a3edad0ab6 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2022-19f4c34184 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2022-9c9691d058 (opens in a new tab)vendor-advisoryx_transferred
• https://security.netapp.com/advisory/ntap-20221028-0009/ (opens in a new tab)x_transferred
• [debian-lts-announce] 20230316 [SECURITY] [DLA 3363-1] pcre2 security update (opens in a new tab)mailing-listx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-1587](https://trackcve.app/badge/CVE-2022-1587.svg)](https://trackcve.app/cve/CVE-2022-1587)

Record last updated 3 Aug 2024, 00:10 UTC.