ALAS2023-2026-3269

References: CVE-2026-103111  CVE-2026-86145  CVE-2026-89156  CVE-2026-89160 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS). (CVE-2026-103111)

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). (CVE-2026-86145)

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. (CVE-2026-89156)

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. (CVE-2026-89160)

Issue Correction:
Run dnf update pcre2 --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3269 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    pcre2-debugsource-10.40-1.amzn2023.0.5.aarch64
    pcre2-debuginfo-10.40-1.amzn2023.0.5.aarch64
    pcre2-utf16-debuginfo-10.40-1.amzn2023.0.5.aarch64
    pcre2-static-10.40-1.amzn2023.0.5.aarch64
    pcre2-utf32-debuginfo-10.40-1.amzn2023.0.5.aarch64
    pcre2-tools-10.40-1.amzn2023.0.5.aarch64
    pcre2-10.40-1.amzn2023.0.5.aarch64
    pcre2-tools-debuginfo-10.40-1.amzn2023.0.5.aarch64
    pcre2-utf16-10.40-1.amzn2023.0.5.aarch64
    pcre2-utf32-10.40-1.amzn2023.0.5.aarch64
    pcre2-devel-10.40-1.amzn2023.0.5.aarch64

noarch:
    pcre2-syntax-10.40-1.amzn2023.0.5.noarch

src:
    pcre2-10.40-1.amzn2023.0.5.src

x86_64:
    pcre2-static-10.40-1.amzn2023.0.5.x86_64
    pcre2-utf32-debuginfo-10.40-1.amzn2023.0.5.x86_64
    pcre2-debugsource-10.40-1.amzn2023.0.5.x86_64
    pcre2-tools-debuginfo-10.40-1.amzn2023.0.5.x86_64
    pcre2-debuginfo-10.40-1.amzn2023.0.5.x86_64
    pcre2-utf16-10.40-1.amzn2023.0.5.x86_64
    pcre2-10.40-1.amzn2023.0.5.x86_64
    pcre2-utf32-10.40-1.amzn2023.0.5.x86_64
    pcre2-utf16-debuginfo-10.40-1.amzn2023.0.5.x86_64
    pcre2-tools-10.40-1.amzn2023.0.5.x86_64
    pcre2-devel-10.40-1.amzn2023.0.5.x86_64