Bug 2481394 (CVE-2026-9496)

Summary:	CVE-2026-9496 pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abuckta, akostadi, amasferr, amctagga, anthomas, aoconnor, bbrownin, bniver, dfreiber, dkuc, dmayorov, drow, dschmidt, ehelms, flucifre, gbenhaim, ggainey, gmalinko, gmeno, groman, gtanzill, janstey, jburrell, jbuscemi, jlanda, jlledo, jpasqual, juwatts, kaycoth, kshier, lchilton, mbenjamin, mdellweg, mhackett, mhulan, mstipich, niyer, nmoumoul, orabin, osousa, pantinor, pcreech, pdelbell, rchan, rexwhite, rhel-process-autobot, rjohnson, rstepani, sdawley, sfeifer, simaishi, smallamp, sostapov, stcannon, sthirugn, teagle, tmalecek, tsedmik, twaugh, vereddy, vkumar, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the pacote component. A remote attacker can exploit this denial of service (DoS) vulnerability by providing a specially crafted input to the `addGitSha` function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can lead to the process stalling or crashing.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2533203, 2533205, 2533206
Bug Blocks:

Description OSIDB Bzimport 2026-05-26 07:01:14 UTC

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic,  causing excessive CPU consumption and potentially stalling or crashing the process.

Comment 5 Jon Orris 2026-10-05 14:37:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:75870 https://access.redhat.com/errata/RHSA-2026:75870

Comment 6 Jon Orris 2026-10-05 15:21:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:75864 https://access.redhat.com/errata/RHSA-2026:75864

Comment 7 Jon Orris 2026-10-07 22:10:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:76750 https://access.redhat.com/errata/RHSA-2026:76750