CVE-2026-102473
Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
- Record
CVE-2026-102473- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2026-88667
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
- Record
EUVD-2026-88667- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3jfv-92rr-qccg
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher...
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
- Record
GHSA-3jfv-92rr-qccg- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
- Record
CVE-2026-102473- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-102473
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
- Record
DEBIAN-CVE-2026-102473- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-102473
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.
- Record
UBUNTU-CVE-2026-102473- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dashDebian:12 |
All versions, plus listed versions 0.5.12+git20240518+f47009f9a76e-10.5.12+git20240518+f47009f9a76e-20.5.12-100.5.12-110.5.12-12 Show 9 moreShow less0.5.12-20.5.12-30.5.12-40.5.12-50.5.12-60.5.12-70.5.12-80.5.12-90.5.13.5-1 |
None known |
dashDebian:13 |
All versions, plus listed versions 0.5.12+git20240518+f47009f9a76e-10.5.12+git20240518+f47009f9a76e-20.5.12-120.5.13.5-1 |
None known |
dashDebian:14 |
All versions, plus listed versions 0.5.12+git20240518+f47009f9a76e-10.5.12+git20240518+f47009f9a76e-20.5.12-120.5.13.5-1 |
None known |
dashUbuntu:14.04:LTS |
All versions, plus listed versions 0.5.7-3ubuntu10.5.7-4ubuntu1 |
None known |
dashUbuntu:16.04:LTS |
All versions, plus listed versions 0.5.7-4ubuntu20.5.8-2.1ubuntu2 |
None known |
dashUbuntu:18.04:LTS |
All versions, plus listed versions 0.5.8-2.3ubuntu10.5.8-2.5ubuntu10.5.8-2.9ubuntu10.5.8-2.10 |
None known |
dashUbuntu:20.04:LTS |
All versions, plus listed versions 0.5.10.2-6 |
None known |
dashUbuntu:22.04:LTS |
All versions, plus listed versions 0.5.11+git20210120+802ebd4-1build10.5.11+git20210903+057cd650a4ed-30.5.11+git20210903+057cd650a4ed-3build1 |
None known |
dashUbuntu:24.04:LTS |
All versions, plus listed versions 0.5.12-6ubuntu10.5.12-6ubuntu30.5.12-6ubuntu40.5.12-6ubuntu5 |
None known |
dashUbuntu:26.10 |
All versions, plus listed versions 0.5.12-12ubuntu3 |
None known |
dashUbuntu:26.04:LTS |
All versions, plus listed versions 0.5.12-12ubuntu20.5.12-12ubuntu3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-102473 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 6, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. No source names a fixed version.