[CLSA-2026:1789737063] Fix CVE(s): CVE-2026-89157, CVE-2026-89158
Type:
security
Severity:
Critical
Release date:
2026-09-18 13:11:16 UTC
Description:
* EA4D-994: Update to 10.48 version * Bundled Unicode data updated 16.0 -> 17.0, changing what existing patterns match with no soname change: \d gains U+11DE0-U+11DE9, \w and \p{L} gain characters too, and U+0320 no longer matches \p{Latin}. Anything linked against libpcre2-8.so.0 sees this on upgrade without a rebuild; alt-php uses PHP's bundled PCRE2 and is not affected.
CVEs fixed:
Updated packages:
  • alt-pcre2_10.48-1_amd64.deb
    sha:9cf0d23697f495804c1b64f87529cea55d8b8576
  • alt-pcre2-dev_10.48-1_amd64.deb
    sha:c3ecb1dbee8afef4ebf98a61936319693303fb74
  • alt-pcre2-static_10.48-1_amd64.deb
    sha:d024111188d94b6886ce06feea40e1443eacdd31
  • alt-pcre2-tools_10.48-1_amd64.deb
    sha:0125bc9df5a56ea6fde36c0961ac1bcfff40e297
  • alt-pcre2-utf16_10.48-1_amd64.deb
    sha:2ebcca57fbd0cf7bff72e3e15f963945658f082c
  • alt-pcre2-utf32_10.48-1_amd64.deb
    sha:b96297fb407a43bd495e216a581d5eaefa184e5e
  • alt-pcre2_10.48-1_arm64.deb
    sha:f92463e02acdb53fc49a4936b0ac7a33428a9f5a
  • alt-pcre2-dev_10.48-1_arm64.deb
    sha:13e50954ba6bd8e33750a21b59699334258199a6
  • alt-pcre2-static_10.48-1_arm64.deb
    sha:dd23de48727afc0d0c9180afd5ba42f451115217
  • alt-pcre2-tools_10.48-1_arm64.deb
    sha:85ef3cc317c6200aeafed990e6d4dd36264686b9
  • alt-pcre2-utf16_10.48-1_arm64.deb
    sha:bec718fc1b08dfcff73c43f1c8fb876ac5179b82
  • alt-pcre2-utf32_10.48-1_arm64.deb
    sha:f274c58e47bf2022d2bcd19efbde89c38c6bb7e3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.