This is a regular release, incorporating security fixes along with fixes and small improvements to library behaviour.

This release is available as before as a (signed) Git tag, or alternatively as a (signed) tarball of the Git tag (attestation).

NEWS

Only changes to behaviour, changes to the API, and other significant changes are described here. Please see the ChangeLog and Git log for further details.

• (Git change) Renamed the default development branch from master to main.

• (Maintenance change) Added a five-year support lifecycle policy and publication of backport patches for security and high-severity fixes in older releases.

• (Security fix for specific API usage, GHSA-2p8c-ff85-vh9x) If pcre2_jit_compile() is called with options for some match modes, and then pcre2_match() is used to perform a match for a different match mode, an out-of-bounds read can occur if the match is attempted against invalid UTF input.

• (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9) If pcre2_convert() is called on untrusted input on platforms with 32-bit size_t, an out-of-bounds heap write can occur.

• (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA matching when using a heap limit; also fixed possible integer overflows which could cause under-allocation of the workspace.

• (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several integer overflows while compiling patterns on 32-bit CPUs, which could cause under-allocation followed by out-of-bounds writes.

• (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to prevent two out-of-bounds reads while scanning backwards through invalid UTF data with PCRE2_MATCH_INVALID_UTF.

• (Matching correctness) Fixed several matching issues:

  • A JIT-specific matching bug affecting prefix scanning on patterns with repeats (#875).
  • A JIT-specific matching bug in variable-length lookbehinds (#912).
  • Miscompiled Unicode character classes combining characters at or below U+00FF with characters at U+0100 and U+8000 or above (#841).
  • Incorrect JIT character advancement with PCRE2_MATCH_INVALID_UTF in UTF-8 and UTF-16 modes, which could skip adjacent characters (#945).

• (Behaviour change) Updated Unicode support to Unicode 17.0.

• (Small behaviour changes) Many small fixes, including pcre2_substitute() improvements, optimisation of possessive backreference matching, and pcre2_compile() fixes.

• (Small build changes) Many small adjustments to the CMake and Zig builds.

• (Security fix for specific API usage, #937) Fixed a leak and later invalid free when calling the fast-path pcre2_jit_match() function with a match data object previously used with pcre2_match() and PCRE2_COPY_MATCHED_SUBJECT.

• (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two uninitialised bytes from malloc() via pcre2_serialize_encode().

New Contributors

• @heitbaum made their first contribution in #879
• @cuiweixie made their first contribution in #888
• @bernardassan made their first contribution in #894
• @puffnfresh made their first contribution in #893
• @mrdimidium made their first contribution in #907
• @nankishre made their first contribution in #922
• @iliaal made their first contribution in #909
• @mattst88 made their first contribution in #938
• @sage-mode-hunter made their first contribution in #948
• @karpovantonme made their first contribution in #947
• @arcusbuilds made their first contribution in #953
• @moyer-avs made their first contribution in #958

This is a regular release, incorporating security fixes along with small improvements and fixes to library behaviour. Please see the NEWS file for further details.

This is a Release Candidate that is being made available for testing.

This is a regular semi-annual release, incorporating a few new features and several maintenance and build improvements.

This release is available as before as a (signed) Git tag, or alternatively as a (signed) tarball of the Git tag (attestation).

NEWS

Only changes to behaviour, changes to the API, and other significant changes are described here. Please see the ChangeLog and Git log for further details.

• (Powerful new feature) Pattern recursion of the form (?1(GROUP_NAME_OR_NUM,...)) acts as a subroutine call which additionally
  returns the listed capturing groups to the calling context.

• (Significant bugfix) Fixed a crash in pcre2_callout_enumerate() which is easily reachable on any pattern that contains a Unicode character class. If your application uses this function, please read the details for this change and evaluate its severity for your application.

• (Build change) There are now linker scripts to enable symbol versioning for the PCRE2 dynamic libraries. Downstream Linux distributions may make use of this, or disable it with the new Autoconf --disable-symvers and CMake -DPCRE2_SYMVERS options. Linux, Solaris, and FreeBSD (GNU ld, LLVM lld, and Solaris ld) are tested and supported.

• (New API function) Added pcre2_next_match(). This function makes it both simpler and safer for clients to iterate over all matches in a subject. The documentation in pcre2api also provides improved guidance in the section "Iterating over all matches".

• (Minor API addition) Added the PCRE2_CONFIG_EFFECTIVE_LINKSIZE option to pcre2_config().

• (Minor replacement syntax extension) Added support for $+ replacement to pcre2_substitute().

• (Build change) Modernize the CMake build files, to use the $<BUILD_INTERFACE:...>, $<INSTALL_INTERFACE:...> and install(EXPORT...) expressions to export the PCRE2 targets.

New Contributors

• @MegaManSec made their first contribution in #701
• @qaptoR made their first contribution in #724
• @feuerste made their first contribution in #729
• @iwamatsu made their first contribution in #746
• @Gsus42 made their first contribution in #789
• @IsaacOscar made their first contribution in #811

This is a security-only release, to address CVE-2025-58050.

Compared to 10.45, this release has only a minimal code change to prevent a read-past-the-end memory error, of arbitrary length. An attacker-controlled regex pattern is required, and it cannot be triggered by providing crafted subject (match) text. The (*ACCEPT) and (*scs:) pattern features must be used together.

Release 10.44 and earlier are not affected.

This could have implications of denial-of-service or information disclosure, and could potentially be used to escalate other vulnerabilities in a system (such as information disclosure being used to escalate the severity of an unrelated bug in another system).

This is a comparatively large release, incorporating new features, some bugfixes, and a few changes with slight backwards compatibility implications. Please see the NEWS file for further details.

This release is the first to be available as a (signed) Git tag, or alternatively as a (signed) tarball of the Git tag.

This is also the first release to be made by the new maintainers of PCRE2, and we would like to thank Philip Hazel, creator and maintainer of PCRE and PCRE2.

This is a comparatively large release, incorporating new features, some bugfixes, and a few changes with slight backwards compatibility implications. Please see the NEWS file for further details.

This is a Release Candidate that is being made available for testing.

This is mostly a bug-fix and tidy-up release. An explicit limit can now be set on the size of a compiled pattern.

There are a lot of changes in this release. Those that are not just bugfixes or source tidies are described in the NEWS file and there is more information in ChangeLog. Note that JIT support for Armv5 is withdrawn in this release. There have only been minor changes since 10.43-RC1.

There are quite a lot of changes in this release. Those that are not just bugfixes or source tidies are described in the NEWS file. This is a Release Candidate that is being made available for testing.

This release is mainly to fix a problem with 10.41, which is broken for programs that include pcre2posix.h but not pcre2.h. Some other minor fixes are included.