What’s Vulnerable › Vulnerabilities
CVE-2019-20454
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-02-14 · updated 2026-06-17
- Weakness: CWE-125
Description
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
Affected products
- Fedoraproject Fedora: 31
- PCRE2: from 10.31 before 10.34 — fixed in 10.34
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
How to fix
Upgrade to a fixed version: PCRE2 10.34; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.
References
- https://bugs.exim.org/show_bug.cgi?id=2421
- https://bugs.php.net/bug.php?id=78338
- https://bugzilla.redhat.com/show_bug.cgi?id=1735494
- https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/
- https://security.gentoo.org/glsa/202006-16
- https://vcs.pcre.org/pcre2?view=revision&revision=1092
- https://bugs.exim.org/show_bug.cgi?id=2421
- https://bugs.php.net/bug.php?id=78338
- https://bugzilla.redhat.com/show_bug.cgi?id=1735494
- https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/
Get alerted when CVE-2019-20454 or the next vulnerability affects your stack