Back to Database
Status published
Critical
CVE-2022-1586
An out-of-bounds read vulnerability was discovered in the PCRE2 library...
Vulnerability Description
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-1586
Credits & Attribution
No credits recorded in the NVD database.
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/
- https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C
- https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C
- https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/
- https://security.netapp.com/advisory/ntap-20221028-0009/
- https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
More from n/a
View All →CVE-2025-9910
Versions of the package jsondiffpatch before 0.7.2 are vulnerable to...
Low
2.3
CVE-2025-9802
RemoteClinic profile.php sql injection
Medium
5.1
CVE-2025-9799
Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery
Low
2.3
CVE-2025-9775
RemoteClinic edit-my-profile.php unrestricted upload
Medium
6.9
CVE-2025-9774
RemoteClinic edit-patient.php information disclosure
Medium
5.3
Affected Vendor
Affected Software
pcre2
Vulnerable Versions:
Fixed in pcre2-10.40.
Timeline
Official Publish:
May 16th, 2022
Last Modified:
March 6th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H