CVE-2022-1587
CRITICAL
Published May 16, 20224y ago · Modified Jun 17, 20262w ago
9.1 CVSS 3.1
Published May 16, 2022 4y ago
Last Modified Jun 17, 2026 2w ago
Description
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-125 Out-of-bounds Read Memory Safety
Affected Products 18
| Vendor | Product | Version | Range |
|---|---|---|---|
| pcre | pcre2 | * | <10.40 |
| redhat | enterprise_linux | 9.0 | any |
| fedoraproject | fedora | 35 | any |
| fedoraproject | fedora | 36 | any |
| netapp | active_iq_unified_manager | * | any |
| netapp | hci_management_node | * | any |
| netapp | ontap_select_deploy_administration_utility | * | any |
| netapp | solidfire | * | any |
| netapp | h300s_firmware | * | any |
| netapp | h300s | * | any |
| netapp | h500s_firmware | * | any |
| netapp | h500s | * | any |
| netapp | h700s_firmware | * | any |
| netapp | h700s | * | any |
| netapp | h410s_firmware | * | any |
| netapp | h410s | * | any |
| netapp | h410c_firmware | * | any |
| netapp | h410c | * | any |
References 8
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C
- github.com https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/
- security.netapp.com https://security.netapp.com/advisory/ntap-20221028-0009/
Remediation
- github.com https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0