CVE-2026-118764

A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at higher optimization levels, leading to resource exhaustion.

This vulnerability is evaluated as having a Moderate impact because exploitation requires non-default preconditions and untrusted input exposure, while the blast radius is confined to an application denial of service. Within typical Red Hat environments, the library operates under default configurations where the flawed pattern compilation path remains inactive. Service disruption can only occur if a downstream application explicitly enables elevated optimization levels while processing unvalidated user-supplied glob expressions, causing thread blocking and memory exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.