CVE-2026-102473 PUBLISHED

Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled

Assigner: redhat
Reserved: 29.09.2026 Published: 29.09.2026 Updated: 29.09.2026

A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown

Workarounds

Rebuild dash with --enable-fnmatch so pathname matching uses libc fnmatch. Until then, do not run dash globs, case, or ${var#pat} / ${var%pat} against attacker-controlled names with multi-star patterns. There is no upstream backtracking bound in the internal matcher.

Credits

  • Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.

References

Problem Types

  • Inefficient Regular Expression Complexity CWE