Incorrect Regular Expression in minimatch - CVE-2016-10540
Published: November 6, 2025
Vulnerability identifier: #VU118143
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10540
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
minimatch
Bitbucket Data Center
IBM Cloud Pak for Business Automation
Business Automation Insights
Bitbucket Data Center
IBM Cloud Pak for Business Automation
Business Automation Insights
How to mitigate CVE-2016-10540
Cybersecurity Help is currently unaware of any official solution to address this vulnerability..
minimatch - update to 3.0.2
Bitbucket Data Center - update to 10.3.2
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
Bitbucket Data Center - update to 10.3.2
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003