AZL-99726

Dashboard / Vulnerabilities / AZL-99726

AZL-99726

Summary: CVE-2026-86145 affecting package pcre2 for versions less than 10.48-1

Details: PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

References: https://nvd.nist.gov/vuln/detail/CVE-2026-86145