CVE-2019-20454: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

Affected products

• Fedoraproject Fedora: version 31 only
• Pcre PCRE2: from 10.31, before 10.34 (fixed in 10.34)
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2020-02-14. Last modified 2026-06-17.