Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

PCRE2 library may crash when processing certain data

CVE-2026-89161 · published 1 month ago
Summary

Versions of the PCRE2 regular‑expression library before 10.48 can incorrectly free memory while handling some input, which can cause the program to stop working or become unstable. This affects any software that uses PCRE2, including packages from Debian, Canonical and other distributions. Update PCRE2 to version 10.48 or later to resolve the issue.

What to do
  • Update debian pcre2 to version 10.48-1.
  • Update debian pcre2 to version 10.42-1+deb12u1.
  • Update debian pcre2 to version 10.46-1~deb13u2.
  • Update pcre2 to version 10.46-r00072.
  • Update rootio-pcre2 to version 10.46-r00072.
  • Update pcre2 to version 10.42-r00071.
  • Update rootio-pcre2 to version 10.42-r00071.
  • Update pcre2 to version 10.46-r00073.
  • Update rootio-pcre2 to version 10.46-r00073.
  • Update pcre2 to version 10.42-r00073.
  • Update rootio-pcre2 to version 10.42-r00073.
  • Update bellsoft pcre2 to version 10.48-r0.
  • Update pcre2 to version 10.48-r0.
  • Update pcre2 to version 10.43-r00071.
  • Update rootio-pcre2 to version 10.43-r00071.
  • Update pcre2 to version 10.48-r00071.
  • Update rootio-pcre2 to version 10.48-r00071.
  • Update pcre2 to version 10.43-r1.
  • Update pcre pcre2 to version 10.48 or later.
Affected software
Ecosystem VendorProductAffected versions
– pcre pcre2 < 10.48
10.48
Debian:12 debian pcre2 < 10.42-1+deb12u1
Fix: upgrade to 10.42-1+deb12u1
Debian:14 debian pcre2 < 10.48-1
Fix: upgrade to 10.48-1
Ubuntu:16.04:LTS canonical pcre2 All versions
Debian:13 debian pcre2 < 10.46-1~deb13u2
Fix: upgrade to 10.46-1~deb13u2
Root:Alpine:3.22 – pcre2 < 10.46-r00072
< 10.46-r00073
Fix: upgrade to 10.46-r00072
Root:Alpine:3.22 – rootio-pcre2 < 10.46-r00072
< 10.46-r00073
Fix: upgrade to 10.46-r00072
Root:Alpine:3.15 – pcre2 < 10.42-r00071
< 10.42-r00073
Fix: upgrade to 10.42-r00071
Root:Alpine:3.15 – rootio-pcre2 < 10.42-r00071
< 10.42-r00073
Fix: upgrade to 10.42-r00071
Alpaquita:25 bellsoft pcre2 >= 10.43-r1, < 10.48-r0
Fix: upgrade to 10.48-r0
Alpaquita:stream bellsoft pcre2 >= 10.40-r1, < 10.48-r0
Fix: upgrade to 10.48-r0
BellSoft Hardened Containers:25 – pcre2 >= 10.43-r1, < 10.48-r0
Fix: upgrade to 10.48-r0
BellSoft Hardened Containers:stream – pcre2 >= 10.40-r1, < 10.48-r0
Fix: upgrade to 10.48-r0
Alpine:v3.24 – pcre2 < 10.48-r0
Fix: upgrade to 10.48-r0
Root:Alpine:3.21 – pcre2 < 10.43-r00071
Fix: upgrade to 10.43-r00071
Root:Alpine:3.21 – rootio-pcre2 < 10.43-r00071
Fix: upgrade to 10.43-r00071
Root:Alpine:3.24 – pcre2 < 10.48-r00071
Fix: upgrade to 10.48-r00071
Root:Alpine:3.24 – rootio-pcre2 < 10.48-r00071
Fix: upgrade to 10.48-r00071
Alpine:v3.21 – pcre2 < 10.43-r1
Fix: upgrade to 10.43-r1
Original advisory text
CVE-2026-89161 in pcre2 - Patched by Root
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-590Free of Memory not on the Heap
Timeline
Published11 Sep 2026
Updated3 Nov 2026
First seen11 Sep 2026
Sources
CVE-2026-89161 · NVD
CVE-2026-89161 · MITRE
DEBIAN-CVE-2026-89161 · OSV
CVE-2026-89161 · OSV
UBUNTU-CVE-2026-89161 · OSV
ROOT-OS-ALPINE-322-CVE-2026-89161 · OSV
ROOT-OS-ALPINE-315-CVE-2026-89161 · OSV
BELL-CVE-2026-89161 · OSV
ALPINE-CVE-2026-89161 · OSV
ROOT-OS-ALPINE-321-CVE-2026-89161 · OSV
ROOT-OS-ALPINE-324-CVE-2026-89161 · OSV
Track software like this
Free during beta