Hey, just in case you have a build pipeline for testing, PCRE has distributed an RC1 that likely addresses this CVE: https://lists.exim.org/lurker/message/20150618.164830.bf6e0148.en.html

Their ChangeLog is here: http://vcs.pcre.org/pcre2/code/trunk/ChangeLog?revision=288&view=markup

Any chance we can get a forecast of how many days beyond a PCRE final release it might take to see a MariaDB release?

(We consider this vulnerability fairly urgent.) Thanks!

Our release schedule is on the main Jira page: http://mariadb.org/jira
In short, if new PCRE release will be out today, it'll be in 10.0.21, that is due in a month.

But we generally build with system pcre and link with libpcre.so dynamically. So it's up to distributions and users to upgrade libprce.so.

Our binary tarballs use bundled pcre, and then our release schedule applies.