CVE-2022-1586: Debian Linux

Critical severity, CVSS 9.1. EPSS: 3.4% chance of exploitation in the next 30 days.

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.

Affected products

Debian Debian Linux: version 10.0 only
Fedoraproject Fedora: version 35 only; version 36 only
Netapp Active Iq Unified Manager: affected versions not specified
Netapp h300s Firmware: affected versions not specified
Netapp h410c Firmware: affected versions not specified
Netapp h410s Firmware: affected versions not specified
Netapp h500s Firmware: affected versions not specified
Netapp h700s Firmware: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Ontap Select Deploy Administration Utility: affected versions not specified
Netapp Solidfire: affected versions not specified
Pcre PCRE2: before 10.40 (fixed in 10.40)
Red Hat Enterprise Linux: version 8.0 only; version 9.0 only

Published 2022-05-16. Last modified 2026-06-17.