[Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48

[Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48

[Bernd Kuhls]

https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

Fixes the following security issues:

(Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
 If pcre2_jit_compile() is called with options for some match modes, and
 then pcre2_match() is used to perform a match for a different match
 mode, an out-of-bounds read can occur if the match is attempted against
 invalid UTF input.

(Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
 If pcre2_convert() is called on untrusted input on platforms with
 32-bit size_t, an out-of-bounds heap write can occur.

(Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
 matching when using a heap limit; also fixed possible integer overflows
 which could cause under-allocation of the workspace.

(Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
 integer overflows while compiling patterns on 32-bit CPUs, which could
 cause under-allocation followed by out-of-bounds writes.

(Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
 prevent two out-of-bounds reads while scanning backwards through
 invalid UTF data with PCRE2_MATCH_INVALID_UTF.

(Security fix for specific API usage, #937) Fixed a leak and later
 invalid free when calling the fast-path pcre2_jit_match() function with
 a match data object previously used with pcre2_match() and
 PCRE2_COPY_MATCHED_SUBJECT.

(Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
 uninitialised bytes from malloc() via pcre2_serialize_encode().

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/a621579b98b143ec2e87173d63a45f475ccbce08

 package/pcre2/pcre2.hash | 4 ++--
 package/pcre2/pcre2.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/pcre2/pcre2.hash b/package/pcre2/pcre2.hash
index 17f15c0fdc..90991322a2 100644
--- a/package/pcre2/pcre2.hash
+++ b/package/pcre2/pcre2.hash
@@ -1,6 +1,6 @@
 # Locally calculated after checking pgp signature:
-# https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2.sig
-sha256  47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7  pcre2-10.47.tar.bz2
+# https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.48/pcre2-10.48.tar.bz2.sig
+sha256  b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed  pcre2-10.48.tar.bz2
 # Locally computed
 sha256  197d8a73ffee0d6b09adba2f9c677b5f5aede24edf89258a68e48248d010d811  LICENCE.md
 sha256  5f216505c0f6ea3273caec89e766eef93cdeb7bbb0c429f9360116d7c938feeb  deps/sljit/LICENSE
diff --git a/package/pcre2/pcre2.mk b/package/pcre2/pcre2.mk
index f2b5608150..ea841f482e 100644
--- a/package/pcre2/pcre2.mk
+++ b/package/pcre2/pcre2.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-PCRE2_VERSION = 10.47
+PCRE2_VERSION = 10.48
 PCRE2_SITE = https://github.com/PCRE2Project/pcre2/releases/download/pcre2-$(PCRE2_VERSION)
 PCRE2_SOURCE = pcre2-$(PCRE2_VERSION).tar.bz2
 PCRE2_LICENSE = BSD-3-Clause
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48

[Julien Olivain via buildroot]

On 10/09/2026 09:37, Bernd Kuhls wrote:
> https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
> 
> Fixes the following security issues:
> 
> (Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
>  If pcre2_jit_compile() is called with options for some match modes, 
> and
>  then pcre2_match() is used to perform a match for a different match
>  mode, an out-of-bounds read can occur if the match is attempted 
> against
>  invalid UTF input.
> 
> (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
>  If pcre2_convert() is called on untrusted input on platforms with
>  32-bit size_t, an out-of-bounds heap write can occur.
> 
> (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
>  matching when using a heap limit; also fixed possible integer 
> overflows
>  which could cause under-allocation of the workspace.
> 
> (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
>  integer overflows while compiling patterns on 32-bit CPUs, which could
>  cause under-allocation followed by out-of-bounds writes.
> 
> (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
>  prevent two out-of-bounds reads while scanning backwards through
>  invalid UTF data with PCRE2_MATCH_INVALID_UTF.
> 
> (Security fix for specific API usage, #937) Fixed a leak and later
>  invalid free when calling the fast-path pcre2_jit_match() function 
> with
>  a match data object previously used with pcre2_match() and
>  PCRE2_COPY_MATCHED_SUBJECT.
> 
> (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
>  uninitialised bytes from malloc() via pcre2_serialize_encode().
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot