Log in Start free

Vulnerability · Published May 16, 2022 · Assigned by redhat

CVE-2022-1587

Critical 9.1

In plain English

A critical-severity out-of-bounds read in pcre2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)2.8%top 13.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pcre210.40-r0ALPINE-CVE-2022-1587
Alpine:v3.21pcre210.40-r0ALPINE-CVE-2022-1587
Alpine:v3.22pcre210.40-r0ALPINE-CVE-2022-1587
Alpine:v3.23pcre210.40-r0ALPINE-CVE-2022-1587
Alpine:v3.24pcre210.40-r0ALPINE-CVE-2022-1587
Debian:12pcre210.40-1DEBIAN-CVE-2022-1587
Debian:13pcre210.40-1DEBIAN-CVE-2022-1587
Debian:14pcre210.40-1DEBIAN-CVE-2022-1587
Rocky Linux:9pcre20:10.37-5.el9_0RLSA-2022:5251
Ubuntu:22.04:LTSpcre210.39-3ubuntu0.1USN-5627-1
Ubuntu:22.04:LTSpcre210.39-3ubuntu0.1UBUNTU-CVE-2022-1587

Affected products (as reported)

VendorProductVersions
n/a pcre2 Fixed in pcre2-10.40.

Weakness: CWE-125

References