Bug 2563607 (CVE-2026-118764)

Summary:	CVE-2026-118764 minimatch: minimatch: Denial of Service via crafted glob pattern expansion
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, abrianik, abuckta, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, anujha, aoconnor, aos-team-art-private, aprice, aschwart, asdas, asoldano, aszczucz, bbaranow, bbrownin, bmaxwell, bniver, boliveir, brasmith, bsmejkal, bstansbe, cdrage, chfoley, cmah, cmyers, cochase, csuconic, dbosanac, dbruscin, dfreiber, dhanak, dkuc, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drichtar, drosa, drow, dschmidt, dsimansk, dymurray, eaguilar, ebaron, ehelms, eshamard, flucifre, fmariani, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, gtanzill, gtully, hasun, ibolton, istudens, ivassile, iweiss, jachapma, janstey, jbalunas, jburrell, jbuscemi, jchui, jdelft, jdobes, jfula, jhe, jhorak, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jraez, jreimann, jsamir, jsherman, jtolenti, jturenov, jupierce, juwatts, jvasik, jwon, kaycoth, kgaikwad, kingland, kshier, ktsao, kvanderr, lblicha, lchilton, lcouzens, lgarciaa, lryznaro, mbenjamin, mbiarnes, mcarlett, mdellweg, mdessi, mhackett, mhulan, mnovotny, mosmerov, mposolda, mreynolds, mrizzi, msauton, mstipich, msvehla, mvyas, nboldt, nmoumoul, nwallace, nyancey, oaljalju, oezr, ogajduse, ometelka, orabin, osousa, pantinor, parichar, pberan, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rblanco, rbobbitt, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, snegrini, sostapov, spichugi, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, swoodman, syedriko, tasato, tbish, tbordaz, tcunning, thjenkin, tlavocat, tmalecek, tsedmik, tsze, vashirov, vdosoudi, vereddy, vkumar, vlaad, vmuzikar, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at higher optimization levels, leading to resource exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 18:15:38 UTC

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.