CVE-2026-59094

Katalog CVE

CVSS 7.5 · High EPSS 0,79%

Kerentanan Inefficient Algorithmic Complexity. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each ** token without memoization, giving exponential worst-case complexity. The filepath_globpattern value is taken from the body of the unauthenticated HTTP endpoints /v1/retrieve, /v1/inputs and /v2/answer and compiled into a filter evaluated once per indexed document, with no length or **-count limit. A remote unauthenticated attacker can submit a short pattern containing many ** tokens to consume CPU for tens of seconds per request, and a small number of requests denies service.

Rincian

Terbit di NVD

2 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/pathwaycom/pathway/commit/d09722eef03fd94bba701836eb4c7fbfa3d3b88e
• https://github.com/pathwaycom/pathway/issues/241
• https://github.com/pathwaycom/pathway/pull/250
• https://www.vulncheck.com/advisories/pathway-unauthenticated-denial-of-service-via-exponential-glob-pattern-ma...