CVE-2026-102473

Name of the Vulnerable Software and Affected Versions dash (affected versions not specified)

Description A flaw exists when the software is built without libc fnmatch. The internal pmatch() function implements the asterisk (*) wildcard using unbounded recursion over candidate positions. A local user capable of creating specific filenames or providing input to this matcher can cause excessive CPU consumption by using a short multi-star pattern, such as *.*.*.*.*.tar.gz.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.