CVE-2026-86145 Overview
CVE-2026-86145 is an out-of-bounds write vulnerability in PCRE2 (Perl Compatible Regular Expressions library) versions before 10.48. The flaw resides in the pcre2_dfa_match function, where the library reuses a cached workspace block during recursive DFA matching without performing a size check. Newly allocated blocks for the same purpose include the size check, but cached reuse does not. Exploitation requires an attacker-controlled regular expression or a recursive pattern combined with a small heap limit configurable through the API. PCRE2 is embedded across countless applications, language runtimes, and network services, expanding the attack surface substantially.
Critical Impact
An out-of-bounds heap write in pcre2_dfa_match can corrupt adjacent memory, leading to integrity compromise and potential process crashes in any application that evaluates untrusted regular expressions.
Affected Products
- PCRE2 library versions prior to 10.48
- Applications and language runtimes bundling vulnerable PCRE2 releases
- Server software exposing regex evaluation on attacker-supplied input
Discovery Timeline
- 2026-09-05 - CVE-2026-86145 published to NVD
- 2026-09-05 - OpenWall OSS-Security notification issued
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86145
Vulnerability Analysis
The vulnerability is classified under [CWE-424: Improper Protection of Alternate Path]. During recursive DFA matching, PCRE2 maintains a workspace to track state across recursion levels. When the matching engine exhausts the current workspace, it either allocates a new block or reuses a previously cached block from an internal cache. The allocation path includes a size validation to ensure the workspace can hold the requested state data. The cached reuse path omits this validation entirely.
An attacker who controls the regular expression can craft a pattern that triggers recursive DFA matching depths sufficient to exhaust the primary workspace and reach the cached-block reuse path. Writes into the undersized cached block spill into adjacent heap memory. The condition can also be reached with a recursive pattern when the heap limit is configured to a small value through the PCRE2 API.
Root Cause
The root cause is a missing bounds check on the reuse code path for cached workspace blocks in recursive DFA matching. The developers added size validation to the allocation path but did not apply the equivalent check when a cached block was reused, creating an inconsistency between two code paths handling the same buffer.
Attack Vector
Exploitation requires the target application to evaluate an attacker-influenced regular expression using pcre2_dfa_match. The attack surface includes web applications that accept user-supplied regex, search functions, WAF rule evaluators, log parsers, and any service exposing regex APIs. No authentication or user interaction is required when the vulnerable code path processes network-supplied input. See the GitHub Security Advisory GHSA-3r4p-g7gg-ppmf for the technical write-up.
Detection Methods for CVE-2026-86145
Indicators of Compromise
- Unexpected crashes or heap corruption reports in processes linking PCRE2, particularly those calling pcre2_dfa_match.
- Application logs showing regex evaluation failures preceded by unusually long or deeply recursive user-supplied patterns.
- Segmentation faults in language runtimes (PHP, Python bindings, Perl) or web servers coinciding with regex operations.
Detection Strategies
- Inventory installed PCRE2 versions across servers and container images; flag any release below 10.48.
- Enable heap protection instrumentation such as AddressSanitizer or GWP-ASan on services that process untrusted regex to catch out-of-bounds writes.
- Instrument application entry points that pass user input to regex engines, logging pattern length and recursion characteristics.
Monitoring Recommendations
- Alert on repeated process crashes in services known to use pcre2_dfa_match.
- Monitor WAF and API gateways for anomalous regex payloads submitted to search, filter, or validation endpoints.
- Track upstream distribution advisories from Debian, Red Hat, SUSE, and Alpine for PCRE2 backports.
How to Mitigate CVE-2026-86145
Immediate Actions Required
- Upgrade PCRE2 to version 10.48 or later across all systems and container base images.
- Rebuild or repackage applications that statically link PCRE2 against the patched release.
- Audit application code paths that accept untrusted regular expressions and constrain pattern complexity where feasible.
Patch Information
The PCRE2 project addressed the missing size check in version 10.48. Refer to the PCRE2 10.48 release notes and the OpenWall OSS-Security update for details on the fix and coordinated distribution updates.
Workarounds
- Reject or sanitize user-supplied regular expressions at the application boundary until PCRE2 can be updated.
- Prefer pcre2_match over pcre2_dfa_match where DFA semantics are not required, as the flaw is specific to the DFA workspace reuse path.
- Avoid configuring unusually small heap limits via the PCRE2 API on untrusted patterns, since small limits combined with recursive patterns reach the vulnerable path.
# Verify installed PCRE2 version on Linux hosts
pcre2-config --version
# Debian/Ubuntu package upgrade
sudo apt-get update && sudo apt-get install --only-upgrade libpcre2-8-0 libpcre2-16-0 libpcre2-32-0
# Red Hat / Rocky / Alma
sudo dnf upgrade pcre2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
