#1146115 poco: please update bundled pcre2 (allocation overflow, commit 8156b39)

Package:
poco
Source:
poco
Submitter:
Gajendra Nath Soren
Date:
2026-10-04 14:03:02 UTC
Severity:
normal
Tags:
#1146115#5
Date:
2026-08-29 22:16:14 UTC
From:
To:
poco vendors a copy of pcre2 at:
Foundation/src/pcre2_substring.c

This copy predates commit 8156b39 (August 9, 2026) which fixes an
integer overflow in pcre2_substring.c and pcre2_convert.c. The fix
adds an overflow guard:

if (size > ((PCRE2_SIZE_MAX - sizeof(pcre2_memctl)) / CU2BYTES(1)) - 1)
return PCRE2_ERROR_NOMEMORY;

No CVE has been assigned yet. The fix is public at:
https://github.com/PCRE2Project/pcre2/commit/8156b39

Please update the bundled pcre2 to the latest upstream version.

Found by: Attack of the Clones GSoC 2026 pipeline
(salsa.debian.org/rouca/gsoc2026)

Gajendra Nath Soren
gajendranath025@gmail.com
#1146115#10
Date:
2026-10-04 14:06:50 UTC
From:
To:

Hi Gajendra,

This issue has been resolved in POCO 1.15.4 with the upgrade to
PCRE2 10.48. I am packaging this new upstream version for Debian,
and this bug will be closed upon upload.

Regards,

Iliya Abolghasemi <gfaerny@gmail.com>