PCRE2, libxml2, and util-linux security releases

Several widely used system and parsing libraries shipped security updates for memory safety, race, and validation flaws. Two narrower projects also disclosed CVEs, one in a retired Apache component with no planned fix.

PCRE2 10.48 security release

PCRE2 10.48 has been released with two security fixes. The changes address JIT match mode mismatches and problems in pattern conversion. Projects that embed the Perl-compatible regular expression engine, especially with JIT enabled, should take the update.

libxml2 2.15.4 memory and bounds fixes

Libxml2 2.15.4 delivers multiple security fixes for out-of-bounds reads, overflows, and missing checks in core XML handling. The library is a common dependency for document and configuration parsing across many stacks. Operators processing untrusted XML input have a direct reason to upgrade.

util-linux 2.42.3 closes four CVEs

util-linux 2.42.3 fixes four CVEs in mount, nsenter, and unshare. The issues involve symlink races and missing O_CLOEXEC handling. Linux systems that rely on these utilities for mounts and namespaces need the release to reduce local privilege and descriptor risks.

Unbounded DNS queries in Robots::Validate

CVE-2026-82309 affects Robots::Validate for Perl in versions from 0.3.2 before 0.3.11. A forward-confirmation loop fails to bound the names it queries and can trigger unbounded outbound DNS traffic per validation. Maintainers of services using this niche module should move to 0.3.11 or later.

SQL injection in retired Apache Griffin module

CVE-2026-52691 describes a SQL injection flaw in the Hive Metastore Module of Apache Griffin. All versions are affected, the project is retired, and no fix will be issued. Remaining installations should remove or isolate the module to avoid query injection exposure.