Inefficient regular expression complexity in picomatch - CVE-2026-33671

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139384

Inefficient regular expression complexity in picomatch - CVE-2026-33671

Published: July 26, 2026


Vulnerability identifier: #VU139384
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33671
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in extglob quantifier handling when parsing input. A remote attacker can send a specially crafted pattern to cause a denial of service.


Affected software

picomatch
Optim
Storage Fusion Data Foundation
QRadar Threat Intelligence
QRadar Deployment Intelligence App
Confluence Data Center
IBM Business Automation Workflow
IBM Automation Decision Services
IBM QRadar Data Synchronization App

How to mitigate CVE-2026-33671

Install security update from vendor's website.

picomatch - addressed in versions 2.3.2, 3.0.2, 4.0.4
Optim - update to 2.0.0
Storage Fusion Data Foundation - update to 4.22
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
IBM Automation Decision Services - addressed in versions 24.0.0.0.9, 24.0.1.0.8, 25.0.0.0.4
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM QRadar Data Synchronization App - update to 4.0.0

External References

Related Security Bulletins