[Informational] libpcre2 10.45–10.47 breaks XML string validation #2673

This is a heads-up only about a defect in PCRE2. It is already fixed upstream, but not yet released. Mentioning it here since it surfaces as a SimpleSAMLphp error that I had really hard time to diagnose.

On a host using PHP with libpcre2 10.45, 10.46 or 10.47, the xml-common's SimpleSAML\XML\Assert\StringTrait::$string_regex stops matching attribute value containing a non-ASCII character which fails validation with SchemaViolationException, and the login dies. ASCII-only values are unaffected, which makes it look like a data problem rather than a regex engine problem.

PCRE issue: PCRE2Project/pcre2#833
Affected libpcre2: 10.45, 10.46, 10.47. 10.44 is fine.

Sample error while testing ADFS authentication which fails on attribute value containing Croatian chars:

SimpleSAML\XMLSchema\Exception\SchemaViolationException:
The value "Ustanova od posebnog značaja za Republiku Hrvatsku" does not match the expected pattern.
  vendor/simplesamlphp/assert/src/Assert.php:502          (Assert::__callStatic)
  vendor/simplesamlphp/xml-common/src/XML/Assert/StringTrait.php:49   (Assert::validString)
  vendor/simplesamlphp/saml11/src/SAML11/Assert/SAMLStringTrait.php:20 (Assert::validSAMLString)
  vendor/simplesamlphp/saml11/src/SAML11/Type/SAMLStringValue.php:21   (SAMLStringValue::validateValue)
  vendor/simplesamlphp/xml-common/src/XMLSchema/Type/Interface/AbstractAnySimpleType.php:34
  modules/adfs/src/IdP/ADFS.php:304                       (ADFS::generatePassiveAssertion)

To reproduce:

<?php
printf("PHP %s | PCRE %s\n", PHP_VERSION, PCRE_VERSION);

// Six ranges. Every one of these should match U+010D (č).
$re = '/^[\x{A0}-\x{D7FF}\x{10000}-\x{1FFFD}\x{20000}-\x{2FFFD}'
    . '\x{30000}-\x{3FFFD}\x{40000}-\x{4FFFD}\x{50000}-\x{5FFFD}]*$/u';

var_dump(preg_match($re, "\u{010D}"));   // expected int(1)

PHP 8.4.21 | PCRE 10.44 2024-06-07   ->  int(1)   correct
PHP 8.4.24 | PCRE 10.47 2025-10-21   ->  int(0)   WRONG

I encountered this with adfs module with simplesamlphp/saml11 + xml-common. I see that saml module uses simplesamlphp/saml2-legacy and there is no such validation in there, but if it moves to the mentioned validation, it will also be affected.

Maybe we should document problematic PCRE versions somewhere in the upgrade logs or somethings