Inefficient Algorithmic Complexity in minimatch - CVE-2026-27903
Published: June 18, 2026
Vulnerability identifier: #VU134878
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-27903
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in matchOne() when processing glob patterns containing multiple non-adjacent GLOBSTAR segments. A remote attacker can supply a specially crafted glob pattern to cause a denial of service.
The issue is triggered on non-matching input and can stall the Node.js event loop while the recursive call tree is fully explored.
Affected software
minimatch
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
How to mitigate CVE-2026-27903
Install security update from vendor's website.
minimatch - addressed in versions 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3
Jira Service Management Data Center - addressed in versions 10.3.22, 11.3.4
Confluence Data Center - addressed in versions 9.2.21, 10.2.10
Jira Software Data Center - addressed in versions 10.3.22, 11.3.4
Jira Service Management Data Center - addressed in versions 10.3.22, 11.3.4
Confluence Data Center - addressed in versions 9.2.21, 10.2.10
Jira Software Data Center - addressed in versions 10.3.22, 11.3.4