CVE-2026-4926
EUVD-2026-1632426.03.2026, 19:17
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.EnginsightAffected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| pillarjs | path-to-regexp | 8.0.0 ≤ 𝑥 < 8.4.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260422-3.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260422-3.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.9-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Migration Toolkit for Virtualization 2.1 | 1779139872 ≤ 𝑥 < * | ADP |
| Red Hat | Migration Toolkit for Virtualization 2.9 | 1778927462 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777386606 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1779773804 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1776784286 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1777903262 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502765 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502438 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194938 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194574 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784126822 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784127736 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Migration Toolkit for Applications 8.1 | 1785169013 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | 1776744110 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | 1776795400 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift distributed tracing 3.9.2 | 1776435608 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Trusted Artifact Signer 1.3 | 1776673130 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Trusted Artifact Signer 1.3 | 1776889929 ≤ 𝑥 < * | ADP |
Debian Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-1333 - Inefficient Regular Expression ComplexityThe product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
References