PCRE2 vulnerabilities

PCRE2 before 10.48 has an out-of-bounds write vulnerability in pcre2_dfa_match due to reuse of a cached workspace block without a size check during recursive DFA matching. This requires an attacker-controlled regular expression or a recursive pattern with a small heap limit.

The pcre2test.c file in PCRE2 version 10.23 contains a vulnerability that allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a 'pattern with very many captures.'