Alibaba Cloud Linux 3 : 0339: pcre2 (ALINUX3-SA-2026:0339)

high Nessus Plugin ID 378774

Synopsis

The remote Alibaba Cloud Linux host is missing one or more security updates.

Description

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0339 advisory.

Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

CVE-2026-103111:
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

CVE-2026-86145:
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

CVE-2026-89157:
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.

CVE-2026-89158:
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of- bounds write.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 378774

File Name: alinux3_sa_2026-0339.nasl

Version: 1.1

Type: Local

Family: Alibaba Cloud Linux Local Security Checks

Published: 11/11/2026

Updated: 11/11/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

Percentile: 95.6

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-89157

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:alibabacloud:alibaba_cloud_linux_3, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:pcre2-devel, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:pcre2-tools, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:pcre2-utf16, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:pcre2-utf32, p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:pcre2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Alibaba/release, Host/Alibaba/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/10/2026

Vulnerability Publication Date: 9/5/2026

Reference Information

CVE: CVE-2026-103111, CVE-2026-86145, CVE-2026-89157, CVE-2026-89158

Detections

Analytics