CVE-2026-102473 — Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant…
Published: 2026-09-29 · CVSS: 5.5 · CVSS 3.1
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7