VYPR
← All advisories
Unrated severityNVD Advisory· Published May 16, 2022· Updated Aug 3, 2024

CVE-2022-1587

CVE-2022-1587

Description

An out-of-bounds read in PCRE2's JIT compiler occurs when processing specific recursive regular expression patterns, potentially leading to application crash or information disclosure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds read in PCRE2's JIT compiler occurs when processing specific recursive regular expression patterns, potentially leading to application crash or information disclosure.

Vulnerability

An out-of-bounds read vulnerability exists in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers [1]. The vulnerability is present in versions prior to the commit 03654e7 [1].

Exploitation

An attacker can trigger this vulnerability by supplying a crafted regular expression pattern containing specific recursive constructs that cause duplicate data transfers during JIT compilation [1]. The attacker does not require any special privileges or authentication, as the vulnerable code path is reachable when PCRE2 processes user-supplied patterns. A successful exploitation does not require user interaction beyond the processing of the malicious pattern.

Impact

A successful out-of-bounds read can lead to the disclosure of sensitive memory contents or cause a denial of service (application crash). The scope of compromise is limited to the context of the application using the PCRE2 library; the attacker may gain access to information that could aid in further exploitation or simply cause the service to terminate [1].

Mitigation

The fix for CVE-2022-1587 was implemented in commit 03654e7 on the PCRE2 repository [1]. Users should update to a version of PCRE2 that includes this commit or later. The Fedora package announcements (references [2], [3], [4]) indicate that updates have been distributed for Fedora distributions [2][3][4]. No workarounds are available other than applying the patch or updating to the fixed version. There is no known inclusion of this CVE in the CISA Known Exploited Vulnerabilities catalog.

References
  1. Fixed an issue affecting recursions in JIT · PCRE2Project/pcre2@03654e7
  2. lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/
  3. lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/
  4. lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

51

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

8

News mentions

0

No linked articles in our index yet.