Home / mailings

PDF

[gentoo-announce] [ GLSA 202611-06 ] PCRE2: Multiple Vulnerabilities

Posted on 12 November 2026
Gentoo-announce

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202611-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: PCRE2: Multiple Vulnerabilities
Date: November 12, 2026
Bugs: #982082, #983449
ID: 202611-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========
Multiple vulnerabilities have been found in PCRE2, the worst of which
could result in arbitrary code execution.

Background
==========
PCRE2 is a project based on PCRE (Perl Compatible Regular Expressions)
which has a new and revised API.

Affected packages
=================
Package Vulnerable Unaffected
----------------- ------------ ------------
dev-libs/libpcre2 < 10.49 >= 10.49

Description
===========
Multiple vulnerabilities have been discovered in PCRE2. Please review
the CVE identifiers referenced below for details.

Impact
======
Please review the referenced CVE identifiers for details.

Workaround
==========
Avoid exposing libpcre2 to attacker-controlled regex.

Resolution
==========
All PCRE2 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/libpcre2-10.49"

References
==========
[ 1 ] CVE-2026-86145
https://nvd.nist.gov/vuln/detail/CVE-2026-86145
[ 2 ] CVE-2026-89156
https://nvd.nist.gov/vuln/detail/CVE-2026-89156
[ 3 ] CVE-2026-89157
https://nvd.nist.gov/vuln/detail/CVE-2026-89157
[ 4 ] CVE-2026-89158
https://nvd.nist.gov/vuln/detail/CVE-2026-89158
[ 5 ] CVE-2026-89160
https://nvd.nist.gov/vuln/detail/CVE-2026-89160
[ 6 ] CVE-2026-89161
https://nvd.nist.gov/vuln/detail/CVE-2026-89161
[ 7 ] CVE-2026-89162
https://nvd.nist.gov/vuln/detail/CVE-2026-89162
[ 8 ] GHSA-2p8c-ff85-vh9x
[ 9 ] GHSA-3r4p-g7gg-ppmf
[ 10 ] GHSA-9qww-pwc4-77qq
[ 11 ] GHSA-fmgr-6ggq-9859
[ 12 ] GHSA-q7rw-r7qq-2hx6
[ 13 ] GHSA-q8g2-wprr-34m9
[ 14 ] GHSA-r9hj-j2rw-4q3m

Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202611-06

Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======
Copyright 2026 Gentoo Authors; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license (CC-BY-SA-4.0).

https://creativecommons.org/licenses/by-sa/4.0
--===============3298348884196384227==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

 

TOP