CVE-2026-102473

MediumCVSS 5.5

Published: 29/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

In the dash shell, when built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames or otherwise feed that matcher can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.

Risk Assessment

A local user could cause excessive CPU consumption, leading to denial-of-service conditions. This affects system availability when processing file patterns.

Recommendation

Update the dash package to a version containing the fix that bounds recursion in pmatch(), or build dash with libc fnmatch support.

Other vulnerabilities in dash

CVE-2026-102474Medium
In the dash shell, the printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b can write one or two bytes past that reservation.

Original NVD description (English source)

A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS