Linux · Security advisory · November 7, 2026

ELSA-2026-81613: Security update for 5 packages

ELSA-2026-81613, released November 7, 2026, fixes 4 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0043
36th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
pcre2ol 80:10.32-4.el8_10
pcre2-develol 80:10.32-4.el8_10
pcre2-toolsol 80:10.32-4.el8_10
pcre2-utf16ol 80:10.32-4.el8_10
pcre2-utf32ol 80:10.32-4.el8_10

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-86145 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). 8.2 0.0043 None reported
High CVE-2026-89157 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. 8.2 0.0035 None reported
High CVE-2026-103111 PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data. 8.2 0.0027 None reported
High CVE-2026-89158 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. 8.2 0.0025 None reported
Showing 1 to 4 of 4 1