The vulnerability arises from dash's internal pmatch() matcher implementing the '*' wildcard using unbounded recursion when libc fnmatch is disabled. This causes short multi-star patterns like '*.*.*.*.*.tar.gz' to consume excessive CPU resources due to super-polynomial backtracking. Exploitation requires local user access and the ability to supply filenames or patterns to the matcher. Standard Red Hat Enterprise Linux builds use glibc fnmatch, which mitigates this issue. The vulnerability results in denial of service via resource exhaustion but does not compromise confidentiality or integrity.

Exploitation of this vulnerability can cause a denial of service by consuming excessive CPU resources on affected systems. It requires local access and the ability to influence filenames or patterns processed by dash. There is no impact on system confidentiality or integrity. The risk is limited on default Red Hat Enterprise Linux systems due to the use of glibc fnmatch. Exposure is mainly in non-standard environments where dash is built without libc fnmatch and untrusted users can provide crafted wildcard expressions.

Red Hat recommends rebuilding dash with the --enable-fnmatch option to use libc fnmatch for pathname matching, which avoids the vulnerable internal matcher. Until a rebuild is performed, avoid running dash globs, case statements, or parameter expansions (${var#pat}, ${var%pat}) against attacker-controlled filenames containing multi-star patterns. There is no upstream limit on backtracking in the internal matcher, so caution is required. No official patch is explicitly stated; mitigation relies on configuration and build options.