Your message dated Mon, 28 Sep 2026 16:20:12 +0000
with message-id <[email protected]>
and subject line Bug#1149217: fixed in pcre2 10.48-3.1
has caused the Debian Bug report #1149217,
regarding pcre2: GHSA-r9hj-j2rw-4q3m: out-of-bounds write in JIT matching with
large stack allocations
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149217: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149217
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pcre2
Version: 10.48-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
From
https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m:
| A regular expression can cause JIT-compiled matching to write outside
| the maximum memory area of a growable JIT stack. A sufficiently large
| single stack allocation may exceed the fixed amount by which the stack
| is grown, allowing subsequent writes below the allocated region.
|
| An attacker must be able to supply a regular expression that is JIT
| compiled and matched by an application using a growable JIT stack.
| Patterns with very large numbers of capturing groups can trigger
| the issue.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: pcre2
Source-Version: 10.48-3.1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
pcre2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated pcre2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 28 Sep 2026 16:04:18 +0200
Source: pcre2
Architecture: source
Version: 10.48-3.1
Distribution: unstable
Urgency: medium
Maintainer: Matthew Vernon <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1149217
Changes:
pcre2 (10.48-3.1) unstable; urgency=medium
.
* Non-maintainer upload.
* GHSA-r9hj-j2rw-4q3m: Fix large JIT stack allocation (Closes: #1149217)
* For release, revert platform-specific test case
Checksums-Sha1:
8e3802b146d72f8d7932e4ae1008238eca67fb5a 2371 pcre2_10.48-3.1.dsc
0dd891adfe8e4ecb677bf086b8e418c54f0fad15 8827 pcre2_10.48-3.1.diff.gz
9c4becfe39cc337ebd84c39d0297a6b41df411a6 5243 pcre2_10.48-3.1_source.buildinfo
Checksums-Sha256:
ab7b0676f36cd9de83e812c800873e53605c09bacad7dc2c203aa7222ac9ab68 2371
pcre2_10.48-3.1.dsc
34420b40e5c1277c4d847ab2b4f54dd58bf8ad63bf5f3995378de73295c788a9 8827
pcre2_10.48-3.1.diff.gz
481b710f633923df85aaf4dad3b928de70e246804346f67dafd7c81ce5484095 5243
pcre2_10.48-3.1_source.buildinfo
Files:
38dcbf1cc91dc45777a9f5a215686ee5 2371 libs optional pcre2_10.48-3.1.dsc
4e53e00b5ddf345885f469fd252efb30 8827 libs optional pcre2_10.48-3.1.diff.gz
2fbdb2533ac2c1a46a3ddc06d447c93f 5243 libs optional
pcre2_10.48-3.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmq6jVBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EN0UP/RYTc/gGAl3d4K+5v6qDCPKSzxnnHv63
T0e86OQ8DrPmio8fLPL/E8P/OlpFST3dhTLmso+Cd1mPh2GV8qZf0Ulp6aCC4d5t
1DtUFrV5WUVKYYhrXBcRQgf85axb1fQnRFLHYu7J/ivZX4UN3xcIHDhIR34M27+/
NjppraPdoAp6JbQUfuZ50bZVg6MlKAfVx6UMqzRjVcehD+vOBTxdyps6kMzZM2qt
TOvh1NLGPK60BGWW9ZNmYvw0Sjm8DlNLWFEekw/+G0d8SVjLj6qZp58gomrs6izu
NlPyCFkmeGcr9hKyXVQcXaYd7FoM49VJum1HeuYrBNJq/K3G1d6rKHDuEwAGc6/u
Ydk1GlkG6AEPGcisQLg1sEmiyySHZyf7RvVIOyn+hNKzxhK9+AnpdqzJo2BRGMha
uUhoIpkghrh7lnJdk3BBT8XVKkyPe6I2K00/DVxR2CYJHS337nyYWYw8e6qAWs5W
f5wuzsh5rg+3Q070SQYNb3cg9tKpWSxtr0wf8ejQSWVRYwW2I5meBGAzFT4nCUxK
N6CaarDwERdVjH+vc0B3z24m0xHs+32l+1QrAE0zSUvPvQeI4oHWGaPTB0ME96Hw
TTlxn+RiT0Kpq1hAKb/K46p/swtXu31yJRLt99zMeJWGvPJIWI2CYZ1KLbGDRozB
/b8Pl+3uxyMx
=cJKd
-----END PGP SIGNATURE-----
pgpScAmWvljyV.pgp
Description: PGP signature
--- End Message ---
