<div style="font-size:inherit" dir="auto">Package: erlang<br style="font-size:inherit">Version: 1:29.0.4+dfsg-1<br style="font-size:inherit">Severity: minor<br style="font-size:inherit">Tags: security<br style="font-size:inherit">X-Debbugs-Cc: <a href="mailto:gajendranath025@gmail.com">gajendranath025@gmail.com</a><br style="font-size:inherit"><br style="font-size:inherit">erlang vendors a copy of pcre2 at:<br style="font-size:inherit">  erts/emulator/pcre/pcre2_substring.c<br style="font-size:inherit"><br style="font-size:inherit">This copy predates commit 8156b39 (August 9, 2026) which fixes an<br style="font-size:inherit">integer overflow in pcre2_substring.c and pcre2_convert.c. The fix<br style="font-size:inherit">adds an overflow guard:<br style="font-size:inherit"><br style="font-size:inherit">  if (size > ((PCRE2_SIZE_MAX - sizeof(pcre2_memctl)) / CU2BYTES(1)) - 1)<br style="font-size:inherit">    return PCRE2_ERROR_NOMEMORY;<br style="font-size:inherit"><br style="font-size:inherit">Note: the canonical Debian pcre2 package (10.46-1) also does not yet<br style="font-size:inherit">contain this fix.<br style="font-size:inherit"><br style="font-size:inherit">No CVE has been assigned yet. The fix is public at:<br style="font-size:inherit">  <a href="https://github.com/PCRE2Project/pcre2/commit/8156b39">https://github.com/PCRE2Project/pcre2/commit/8156b39</a><br style="font-size:inherit"><br style="font-size:inherit">Please update the bundled pcre2 to the latest upstream version.<br style="font-size:inherit"><br style="font-size:inherit">Found by: Attack of the Clones GSoC 2026 pipeline<br style="font-size:inherit">  (<a href="http://salsa.debian.org/rouca/gsoc2026">salsa.debian.org/rouca/gsoc2026</a>)<br style="font-size:inherit"><br style="font-size:inherit">Gajendra Nath Soren<br style="font-size:inherit"><a href="mailto:gajendranath025@gmail.com">gajendranath025@gmail.com</a></div>