[CLSA-2026:1789737217] alt-pcre2: Fix of 2 CVEs
Type:
security
Severity:
Critical
Release date:
2026-09-18 13:13:49 UTC
Description:
- EA4D-994: Update to 10.48 version - Bundled Unicode data updated 16.0 -> 17.0, which changes what already-written patterns match with no code change and no soname bump: \d gains 10 characters (U+11DE0-U+11DE9), \w gains 4696 and \p{L} gains 4644. Those three are purely additive; the only removal is U+0320, which no longer matches \p{Latin}. Anything dynamically linked against libpcre2-8.so.0 therefore sees the new behaviour on upgrade without being rebuilt. alt-php is not affected: it compiles PHP's bundled PCRE2 (--with-external-pcre is not passed), so its "Requires: alt-pcre2" is vestigial and not evidence of linkage. - Rebased pcre2-10.10-Fix-multilib.patch: upstream reworked the pcre2-config libS block into a case statement that does not cover /opt/alt
Updated packages:
  • alt-pcre2-10.48-1.el7.x86_64.rpm
    sha:71111274500951cbc583b688d3749b101a0b4ceebecdc6b5f3b3862931befe06
  • alt-pcre2-devel-10.48-1.el7.x86_64.rpm
    sha:8d06f12ab544665eb2feb3519391af887ed8d9857010388e967d81992ea20c3c
  • alt-pcre2-static-10.48-1.el7.x86_64.rpm
    sha:e443b0094ff3e1374518d7034d83bee0ebd803cfd18d0eb9487010e75057cd22
  • alt-pcre2-tools-10.48-1.el7.x86_64.rpm
    sha:426bf9b480fbf4bc211d8605957d23cf084004c79ba068c9fe528328028cae7e
  • alt-pcre2-utf16-10.48-1.el7.x86_64.rpm
    sha:c48794d63f9848f1ed040375025ecdd0f0f88be91bbaf58022740d40bae54022
  • alt-pcre2-utf32-10.48-1.el7.x86_64.rpm
    sha:249aa270e843f43607f53fc5cc1b4824856c45b7453524d2cec8bdb93cd4f515
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.