CVE-2026-102473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102473", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-29T08:38:18.889Z", "datePublished": "2026-09-29T09:22:54.336Z", "dateUpdated": "2026-11-05T16:04:00.064Z"}, "containers": {"cna": {"title": "Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "dash", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-102473", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543005", "name": "RHBZ#2543005", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-29T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-1333: Inefficient Regular Expression Complexity", "workarounds": [{"lang": "en", "value": "Rebuild dash with --enable-fnmatch so pathname matching uses libc fnmatch. Until then, do not run dash globs, case, or ${var#pat} / ${var%pat} against attacker-controlled names with multi-star patterns. There is no upstream backtracking bound in the internal matcher."}], "timeline": [{"lang": "en", "time": "2026-09-29T08:34:06.065Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-29T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T16:04:00.064Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:42:25.405325Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:11:10.442Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:42:25.405325Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:42:30.491Z"}}], "cna": {"title": "Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled", "credits": [{"lang": "en", "value": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "dash", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-09-29T08:34:06.065Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-29T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-09-29T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-102473", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543005", "name": "RHBZ#2543005", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Rebuild dash with --enable-fnmatch so pathname matching uses libc fnmatch. Until then, do not run dash globs, case, or ${var#pat} / ${var%pat} against attacker-controlled names with multi-star patterns. There is no upstream backtracking bound in the internal matcher."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T16:04:00.064Z"}, "x_redhatCweChain": "CWE-1333: Inefficient Regular Expression Complexity"}}, "cveMetadata": {"cveId": "CVE-2026-102473", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:04:00.064Z", "dateReserved": "2026-09-29T08:38:18.889Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-29T09:22:54.336Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "dash", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}], "id": "CVE-2026-102473", "lastModified": "2026-11-05T17:17:31.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102473", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T19:42:25.405325Z", "version": "2.0.3"}}]}, "published": "2026-09-29T10:17:10.383", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-102473"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543005"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.", "bugzilla": {"description": "dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled", "id": "2543005", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543005"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."], "mitigation": {"lang": "en:us", "value": "Rebuild dash with --enable-fnmatch so pathname matching uses libc fnmatch. Until then, do not run dash globs, case, or ${var#pat} / ${var%pat} against attacker-controlled names with multi-star patterns. There is no upstream backtracking bound in the internal matcher."}, "name": "CVE-2026-102473", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "dash", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2026-09-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102473"], "statement": "Red Hat rates this vulnerability as having a Moderate impact because exploitation requires local access and can only result in a denial of service through excessive CPU resource consumption, without compromising system confidentiality or integrity. Furthermore, standard builds on Red Hat Enterprise Linux utilize glibc pattern matching facilities rather than the standalone fallback implementation, significantly limiting exposure under default configurations. Exploitation is constrained to non-standard environments where internal pattern expansion is active and untrusted users are permitted to provide wildcard expressions or crafted directory structures.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 6", "source": "cna", "vendor": "Red Hat"}, "product": "dash", "vendor": "dash"}], "created": "2026-09-29T15:15:14.046067+00:00", "updated": "2026-09-30T04:15:08.187513+00:00", "vendors": ["dash", "dash$PRODUCT$dash"]}