CVE-2026-102473 in Red Hat
Summary
by MITRE • 09/29/2026
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in the dash shell involves a critical implementation flaw within its internal filename matching mechanism, specifically affecting systems compiled without support for the standard C library function fnmatch. Dash is widely deployed as /bin/sh on many Linux distributions due to its small footprint and fast startup time, making this issue particularly impactful across a broad range of environments. The core technical defect lies in how the pmatch() matcher handles wildcard patterns containing multiple asterisks when operating in its native mode rather than delegating to libc. In this specific configuration, the algorithm attempts to match variable-length sequences by employing unbounded recursion over candidate positions within the target string. This design choice fails to implement adequate bounds checking or iterative optimization strategies that are typically present in more robust regular expression engines or standard library implementations.
When a local user is able to influence the input passed to this matching function, they can trigger an exponential increase in computational complexity. By providing filenames or strings that contain patterns with multiple stars, such as ..., the shell enters into deep recursive calls without sufficient termination conditions relative to the input length. This results in excessive CPU consumption and effectively creates a denial of service condition for the affected process. The impact is localized to the user session where the vulnerable command is executed, but it can lead to system-wide resource exhaustion if multiple processes are triggered simultaneously or if the shell is used within scripts that loop over untrusted inputs.
From a classification perspective, this vulnerability aligns with CWE-675, which describes operations with duplicate input sequences, and more broadly with CWE-400 regarding Uncontrolled Resource Consumption. The attack vector requires local access to plant filenames or feed specific strings into shell expansions, placing it within the ATT&CK framework under techniques related to resource hijacking via command execution. It does not allow for remote code execution but serves as a potent tool for disrupting service availability through computational exhaustion.
Mitigation strategies primarily involve updating dash to versions that have patched this recursive logic or ensuring that the build configuration includes support for libc fnmatch, which utilizes optimized and bounded matching algorithms provided by the operating system's standard library. System administrators should verify their shell version and apply available patches from distribution vendors promptly. Additionally, developers writing scripts that process untrusted filenames should avoid relying on complex globbing patterns with multiple wildcards in contexts where input is not strictly controlled or sanitized, opting instead for explicit iteration loops with simpler matching criteria to prevent similar resource exhaustion issues in other tools.