CVE-2026-102473

Vendor solution

Rebuild dash with --enable-fnmatch so pathname matching uses libc fnmatch. Until then, do not run dash globs, case, or ${var#pat} / ${var%pat} against attacker-controlled names with multi-star patterns. There is no upstream backtracking bound in the internal matcher.

Red Hat statement

Red Hat rates this vulnerability as having a Moderate impact because exploitation requires local access and can only result in a denial of service through excessive CPU resource consumption, without compromising system confidentiality or integrity. Furthermore, standard builds on Red Hat Enterprise Linux utilize glibc pattern matching facilities rather than the standalone fallback implementation, significantly limiting exposure under default configurations. Exploitation is constrained to non-standard environments where internal pattern expansion is active and untrusted users are permitted to provide wildcard expressions or crafted directory structures.

Red Hat mitigation

Rebuild dash with --enable-fnmatch so pathname matching uses libc fnmatch. Until then, do not run dash globs, case, or ${var#pat} / ${var%pat} against attacker-controlled names with multi-star patterns. There is no upstream backtracking bound in the internal matcher.