Inefficient regular expression complexity in minimatch - CVE-2026-26996

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123140

Inefficient regular expression complexity in minimatch - CVE-2026-26996

Published: February 23, 2026


Vulnerability identifier: #VU123140
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-26996
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within "minimatch" function. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.


Affected software

minimatch
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
cockpit-tukit
nodejs-nodemon
npm
nodejs-devel
nodejs
nodejs-full-i18n
nodejs-docs
nodejs22 (Red Hat package)
nodejs24 (Red Hat package)
cockpit-podman
cockpit-machines
cockpit
cockpit-bridge
cockpit-debuginfo
cockpit-debugsource
cockpit-bridge-debuginfo
cockpit-ws
cockpit-ws-debuginfo
cockpit-system
nodejs-packaging
nodejs-packaging-bundler
Fusion Content-Aware Storage
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
Guardium Data Security Center (GDSC)
Storage Fusion Data Foundation
watsonx Code Assistant On Prem
Maximo Application Suite - IoT Component
Rational Performance Tester
DevOps Test Performance
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
QRadar Threat Intelligence
Db2 Big SQL
Maximo Scheduler Optimizer
InfoSphere Optim Archive Viewer
IBM Cloud Pak System
IBM Fusion HCI
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Watson Discovery for IBM Cloud Pak for Data
Confluence Data Center
IBM Maximo Application Suite - Manage Component
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Event Streams
IBM QRadar Data Synchronization App
IBM Security SOAR
Red Hat OpenShift Container Platform
OpenShift Data Foundation (formerly OpenShift Container Storage)

How to mitigate CVE-2026-26996

Install updates from vendor's website.

minimatch - addressed in versions 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1
Fusion Content-Aware Storage - update to 1.1.5
Cognos Analytics Mobile (iOS) - update to 1.1.26
Cognos Analytics Mobile (Android) - update to 1.1.26
IBM Cloud Pak System - update to 2.3.6.2
IBM Fusion HCI - update to 2.13.0
Guardium Data Security Center (GDSC) - update to 3.8.8
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.18-sc2, 4.3.2
Storage Fusion Data Foundation - update to 4.22
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
watsonx Code Assistant On Prem - update to 5.3.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.32, 8.8.29, 9.0.18, 9.1.9
Confluence Data Center - addressed in versions 9.2.21, 10.2.10
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.29, 9.1.21, 9.2.2
Event Streams - update to 13.0.0
DevOps Test Performance - update to 11.0.8
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.22, 16.1.3.4
IBM Security SOAR - update to 51.0.9.1
cockpit-tukit - update to 0.0.3~git14.ff11a9a-150300.1.9.1
nodejs-nodemon - update to 3.0.1-1
npm - update to 10.8.2-1.20.20.2.1
nodejs-devel - update to 20.20.2-1
nodejs - update to 20.20.2-1
nodejs-full-i18n - update to 20.20.2-1
nodejs-docs - update to 20.20.2-1
nodejs22 (Red Hat package) - addressed in versions 22.22.2-1.el10_1, 22.22.2-2.el10_0
nodejs24 (Red Hat package) - update to 24.14.1-2.el10_1
cockpit-podman - update to 33-150300.6.9.1
cockpit-machines - update to 249.1-150300.5.6.1
cockpit - update to 251.3-150300.6.9.1
cockpit-bridge - update to 251.3-150300.6.9.1
cockpit-debuginfo - update to 251.3-150300.6.9.1
cockpit-debugsource - update to 251.3-150300.6.9.1
cockpit-bridge-debuginfo - update to 251.3-150300.6.9.1
cockpit-ws - update to 251.3-150300.6.9.1
cockpit-ws-debuginfo - update to 251.3-150300.6.9.1
cockpit-system - update to 251.3-150300.6.9.1
nodejs-packaging - update to 2021.06-6
nodejs-packaging-bundler - update to 2021.06-6
QRadar Threat Intelligence - update to 2.6.0
IBM QRadar Data Synchronization App - update to 4.0.0
Red Hat OpenShift Container Platform - addressed in versions 4.16.66, 4.18.48
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.25, 4.19.20
Db2 Big SQL - update to 8.3.1 patch 4
Maximo Scheduler Optimizer - addressed in versions 8.4.28, 8.5.28, 9.0.22, 9.1.11
InfoSphere Optim Archive Viewer - update to 11.7.0.14

External References

Related Security Bulletins