On Sun, 30 Aug 2026 03:46:14 +0530 Gajendra Nath Soren <[email protected]> wrote: > Package: poco > Version: 1.14.2-6 > Severity: minor > Tags: security > X-Debbugs-Cc: [email protected] > > poco vendors a copy of pcre2 at: > Foundation/src/pcre2_substring.c > > This copy predates commit 8156b39 (August 9, 2026) which fixes an > integer overflow in pcre2_substring.c and pcre2_convert.c. The fix > adds an overflow guard: > > if (size > ((PCRE2_SIZE_MAX - sizeof(pcre2_memctl)) / CU2BYTES(1)) - 1) > return PCRE2_ERROR_NOMEMORY; > > No CVE has been assigned yet. The fix is public at: > https://github.com/PCRE2Project/pcre2/commit/8156b39 > > Please update the bundled pcre2 to the latest upstream version. > > Found by: Attack of the Clones GSoC 2026 pipeline > (salsa.debian.org/rouca/gsoc2026) > > Gajendra Nath Soren > [email protected]
Hi Gajendra, This issue has been resolved in POCO 1.15.4 with the upgrade to PCRE2 10.48. I am packaging this new upstream version for Debian, and this bug will be closed upon upload. Regards, Iliya Abolghasemi <[email protected]>
