[CLSA-2026:1789737391] alt-pcre2: Fix of 2 CVEs
Type:
security
Severity:
Critical
Release date:
2026-09-18 13:16:43 UTC
Description:
- EA4D-994: Update to 10.48 version - Bundled Unicode data updated 16.0 -> 17.0, which changes what already-written patterns match with no code change and no soname bump: \d gains 10 characters (U+11DE0-U+11DE9), \w gains 4696 and \p{L} gains 4644. Those three are purely additive; the only removal is U+0320, which no longer matches \p{Latin}. Anything dynamically linked against libpcre2-8.so.0 therefore sees the new behaviour on upgrade without being rebuilt. alt-php is not affected: it compiles PHP's bundled PCRE2 (--with-external-pcre is not passed), so its "Requires: alt-pcre2" is vestigial and not evidence of linkage. - Rebased pcre2-10.10-Fix-multilib.patch: upstream reworked the pcre2-config libS block into a case statement that does not cover /opt/alt
Updated packages:
  • alt-pcre2-10.48-1.el8.x86_64.rpm
    sha:616241cf300e2e7fa9a83c2920a9be0fe0fc71c9f5438a64be8705d6e5710930
  • alt-pcre2-devel-10.48-1.el8.x86_64.rpm
    sha:57c0884ef35a3e2b7082ea217e3c5fb318445a1ad445ee5ed7c303dbfefe1952
  • alt-pcre2-static-10.48-1.el8.x86_64.rpm
    sha:3e351259751a647d717012f1618644f513880c1cc14cdd2a71e1389394052755
  • alt-pcre2-tools-10.48-1.el8.x86_64.rpm
    sha:eea1b9a981ec95735aaac4f5e833fda2cbbbc3ee50bdeb0f36b718372b9ef364
  • alt-pcre2-utf16-10.48-1.el8.x86_64.rpm
    sha:0b65ebf5b5fdebe39dd0867ba283b3a375653e2e63cd5ee16e4b335fb911f4e0
  • alt-pcre2-utf32-10.48-1.el8.x86_64.rpm
    sha:c99608442ee338e52f6d6f4d93e38dfde844e538a58386441ddc8dcbbd37372b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.