CVE-2026-118773

A flaw was found in glob, which can lead to a Denial of Service (DoS). When an application attempts to cancel an active file search or encounters a timeout, the library fails to properly halt execution and continues scanning directories in the background. A remote attacker can exploit this issue by supplying inputs that trigger cancellations, causing multiple background filesystem operations to accumulate. This unconstrained activity exhausts system resources and degrades service availability.

This vulnerability is rated as having Moderate impact because triggering the denial of service requires an application to accept untrusted search patterns or directory paths while relying on cancellation signals to constrain execution duration. Although background filesystem traversal continues following an abort notification, typical Red Hat deployments do not expose unbounded cancellation-driven file searches directly to unauthenticated network users. Consequently, the flaw cannot lead to arbitrary code execution, unauthorized data modification, or information disclosure, limiting the overall impact to service degradation through worker resource starvation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.