CVE-2026-102473: Dash Shell DoS Vulnerability

CVE-2026-102473 Overview

A flaw exists in the dash shell when built without libc fnmatch. The internal pmatch() matcher implements the * wildcard through unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed input to that matcher, can trigger excessive CPU consumption using a short multi-star pattern such as *.*.*.*.*.tar.gz. This algorithmic complexity issue is tracked as CWE-1333: Inefficient Regular Expression Complexity.

Critical Impact
Local attackers can exhaust CPU resources on systems running dash compiled without libc fnmatch, resulting in denial-of-service conditions for shell operations and dependent scripts.

Affected Products

dash (Debian Almquist Shell) builds compiled without libc fnmatch support
Downstream Linux distributions packaging vulnerable dash builds
Systems tracked under Red Hat Bug Report #2543005

Discovery Timeline

2026-09-29 - CVE CVE-2026-102473 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102473

Vulnerability Analysis

The vulnerability resides in the pmatch() function inside dash. This internal matcher handles pathname pattern expansion when the shell is built without linking against libc fnmatch(). The implementation processes the * wildcard by recursively attempting every candidate split position in the input string.

When a pattern contains multiple * metacharacters interspersed with literal segments, the recursion depth and branching factor grow rapidly. A pattern like *.*.*.*.*.tar.gz matched against a moderately long filename forces exponential backtracking. The shell process consumes CPU cycles until the operation completes or the process is killed.

Because exploitation requires local access and only affects availability, the impact is bounded to the host running the vulnerable dash binary. Confidentiality and integrity are not affected. See the Red Hat CVE record for distribution-specific analysis.

Root Cause

The root cause is an inefficient pattern-matching algorithm [CWE-1333]. The pmatch() implementation lacks memoization, iterative bounds, or early pruning when evaluating * against literal anchors. Each additional * multiplies the number of recursive calls, producing worst-case behavior on adversarially crafted inputs.

Attack Vector

A local user triggers the flaw by causing dash to expand a crafted glob pattern. Common vectors include planting filenames that a script iterates over, supplying pattern arguments to shell built-ins that call pmatch(), or invoking scripts that pass user-controlled data through case statements or filename generation. The attacker needs low privileges and no user interaction on the target.

No verified public exploit code is available. The vulnerability mechanism is described in the referenced advisories.

Detection Methods for CVE-2026-102473

Indicators of Compromise

Sustained high CPU utilization by dash or /bin/sh processes with no corresponding I/O activity
Shell processes stuck expanding filename globs containing multiple * characters
Cron jobs, init scripts, or package post-install hooks that hang or time out during glob expansion

Detection Strategies

Audit process accounting logs for dash invocations exceeding expected CPU time thresholds
Correlate long-running shell processes with the command-line arguments and working directory contents that triggered them
Inventory systems where /bin/sh links to dash and verify whether the build includes libc fnmatch support

Monitoring Recommendations

Alert on shell processes consuming more than a defined CPU threshold for an extended period
Monitor directories writable by untrusted users for filenames containing multiple dots or wildcard-like sequences
Track package manager events that update dash to confirm patched versions are deployed

How to Mitigate CVE-2026-102473

Immediate Actions Required

Apply vendor updates for dash as they become available from your Linux distribution
Restrict write access to directories that are enumerated by scripts running as elevated users
Review shell scripts that expand user-controlled glob patterns and add input length or complexity limits

Patch Information

Refer to the Red Hat CVE-2026-102473 advisory and Red Hat Bug Report #2543005 for patch status and package versions. Distributions that build dash against libc fnmatch are not affected by the recursive matcher path.

Workarounds

Rebuild dash with libc fnmatch support so the vulnerable pmatch() code path is not used
Replace dash as /bin/sh with an alternative shell on systems that do not require its behavior, where compatibility permits
Enforce CPU time limits on shell processes using ulimit -t or systemd CPUQuota= for services invoking shell scripts

bash

# Configuration example
# Limit CPU time for a systemd service that invokes shell scripts
# /etc/systemd/system/example.service.d/limits.conf
[Service]
CPUQuota=50%
LimitCPU=30