CVE-2026-102473: Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
Published Sep 29, 2026
·Updated
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as .....tar.gz consume excessive CPU.
Affected Software
1 affected component
Dash dash
Event History
Sep 29, 2026
Data Sourced
via Red Hat·08:36 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·09:22 AM
Data Sourced
via MITRE·09:22 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed to this issue?
The issue affects dash builds that are compiled without libc fnmatch and therefore use dash's internal pmatch() matcher. Deployments using libc fnmatch are not identified as affected by the provided information.
2
What must an attacker be able to do to trigger the excessive CPU use?
A local user must be able to plant filenames or otherwise provide input to the internal matcher. They can use a short pattern with multiple stars, such as *.*.*.*.*.tar.gz, to drive excessive CPU consumption.