A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements by unbounded recursion over candidate positions. (CVE-2026-102473)

The dash shell contains a vulnerability (CVE-2026-102473) where, if built without the libc fnmatch function, its internal pmatch() matcher uses unbounded recursion over candidate positions when processing patterns with multiple stars (e.g., *.*.*.*.*.tar.gz). This can cause excessive CPU usage when a local user can influence the filenames matched. The issue is a denial-of-service type affecting availability but does not impact confidentiality or integrity.

The vulnerability allows a local user to cause excessive CPU consumption by providing specially crafted filename patterns to the pmatch() matcher in dash when libc fnmatch is not used. This results in a denial-of-service condition affecting system availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running dash builds without libc fnmatch or restrict local user ability to supply filenames to the matcher to mitigate potential CPU exhaustion.