CVE catalog

CVE-2022-1587

pcre2: CVE-2022-1587

Severity: High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Published: May 12, 2022, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.77% · Oct 25, 2026

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pcre2	sid	`10.48-3.1`	fixed
Debian	pcre2	forky	`10.48-3.1`	fixed
Debian	pcre2	trixie	`10.46-1~deb13u2`	fixed
Debian	pcre2	trixie-security	`10.46-1~deb13u3`	fixed
Debian	pcre2	bookworm	`10.42-1`	fixed
Debian	pcre2	bookworm-security	`10.42-1+deb12u2`	fixed
Ubuntu	pcre2	16.04	`10.20-1`	vulnerable
Ubuntu	pcre2	16.04	`10.20-2`	vulnerable
Ubuntu	pcre2	16.04	`10.20-3`	vulnerable
Ubuntu	pcre2	16.04	`10.21-1`	vulnerable
Ubuntu	pcre2	pro	`10.22-3`	vulnerable
Ubuntu	pcre2	pro	`10.22-4`	vulnerable
Ubuntu	pcre2	pro	`10.22-5`	vulnerable
Ubuntu	pcre2	pro	`10.22-6`	vulnerable
Ubuntu	pcre2	pro	`10.31-2`	vulnerable
Ubuntu	pcre2	pro	`10.31-2ubuntu0.1~esm1`	fixed
Ubuntu	pcre2	20.04	`10.32-5`	vulnerable
Ubuntu	pcre2	20.04	`10.34-7`	vulnerable
Ubuntu	pcre2	20.04	`10.34-7ubuntu0.1`	fixed
Ubuntu	pcre2	22.04	`10.37-0ubuntu2`	vulnerable
Ubuntu	pcre2	22.04	`10.39-3`	vulnerable
Ubuntu	pcre2	22.04	`10.39-3build1`	vulnerable
Ubuntu	pcre2	22.04	`10.39-3ubuntu0.1`	fixed
Suse	pcre2	linux enterprise module for basesystem 15 sp4	`10.39-150400.4.6.1`	fixed
Opensuse	pcre2	leap 15.4	`10.39-150400.4.6.1`	fixed
Suse	pcre2	openstack cloud 9	`10.34-1.10.1`	fixed
Suse	pcre2	openstack cloud crowbar 9	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise server for sap applications 12 sp4	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise software development kit 12 sp5	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise server 12 sp2-bcl	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise server 12 sp3-bcl	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise server 12 sp4-ltss	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise server 12 sp5	`10.34-1.10.1`	fixed
Suse	pcre2	linux enterprise server for sap applications 12 sp5	`10.34-1.10.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pcre2	source	sid	`10.40-1`	not yet assigned	Not reported	[1011954]
Debian	pcre2	source	forky	`10.40-1`	not yet assigned	Not reported	[1011954]
Debian	pcre2	source	trixie	`10.40-1`	not yet assigned	Not reported	[1011954]
Debian	pcre2	source	bookworm	`10.40-1`	not yet assigned	Not reported	[1011954]
Ubuntu	pcre2	deb	pro	`10.31-2ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2022-1587	Not reported
Ubuntu	pcre2	deb	20.04	`10.34-7ubuntu0.1`	Not reported	UBUNTU-CVE-2022-1587	Not reported
Ubuntu	pcre2	deb	22.04	`10.39-3ubuntu0.1`	Not reported	UBUNTU-CVE-2022-1587	Not reported
Suse	pcre2	rpm	linux enterprise module for basesystem 15 sp4	`10.39-150400.4.6.1`	Not reported	SUSE-SU-2022:2566-1	Not reported
Opensuse	pcre2	rpm	leap 15.4	`10.39-150400.4.6.1`	Not reported	SUSE-SU-2022:2566-1	Not reported
Suse	pcre2	rpm	openstack cloud 9	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	openstack cloud crowbar 9	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise server for sap applications 12 sp4	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise software development kit 12 sp5	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise server 12 sp2-bcl	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise server 12 sp3-bcl	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise server 12 sp4-ltss	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise server 12 sp5	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported
Suse	pcre2	rpm	linux enterprise server for sap applications 12 sp5	`10.34-1.10.1`	Not reported	SUSE-SU-2022:2565-1	Not reported

[Debian bug #1011954]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libpcre2-16-0]Unknown
Source package: [pcre2]
Details (2)
- 10.42-1 · amd64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
- 10.42-1 · arm64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
[libpcre2-32-0]Unknown
Source package: [pcre2]
Details (2)
- 10.42-1 · amd64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
- 10.42-1 · arm64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
[libpcre2-8-0]Unknown
Source package: [pcre2]
Details (2)
- 10.42-1 · amd64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
- 10.42-1 · arm64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
[libpcre2-dev]Unknown
Source package: [pcre2]
Details (2)
- 10.42-1 · amd64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
- 10.42-1 · arm64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
[libpcre2-posix3]Unknown
Source package: [pcre2]
Details (2)
- 10.42-1 · amd64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
- 10.42-1 · arm64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
[pcre2-utils]Unknown
Source package: [pcre2]
Details (2)
- 10.42-1 · amd64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm
- 10.42-1 · arm64 · bookworm
  Fixed · Fixed: 10.40-1
  dsa · pcre2 · debian · bookworm

Observed: Oct 23, 2026, 6:23:11 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]