{"id":"CVE-2026-59094","title":"Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store","summary":"Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each ** token without memoization, giving e…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-407"],"vendor":"pathwaycom","product":"pathway","affected":["pathway <= 0.31.1"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-06T16:19:28.535653Z"},"exploitAvailable":true,"published":"2026-07-02","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:16.786Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59094","references":[{"url":"https://github.com/pathwaycom/pathway/issues/241","label":"Researcher Disclosure"},{"url":"https://github.com/pathwaycom/pathway/pull/250","label":"Fix PR"},{"url":"https://github.com/pathwaycom/pathway/commit/d09722eef03fd94bba701836eb4c7fbfa3d3b88e","label":"Fix Commit"},{"url":"https://www.vulncheck.com/advisories/pathway-unauthenticated-denial-of-service-via-exponential-glob-pattern-matching-in-document-store"}],"tags":["cve.org","exploit-available"],"epss":0.00793,"epssPercentile":0.56599,"ingestedAt":"2026-11-08T14:51:22.287Z","slug":"CVE-2026-59094","body":"## Overview\n\nPathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each ** token without memoization, giving exponential worst-case complexity. The filepath_globpattern value is taken from the body of the unauthenticated HTTP endpoints /v1/retrieve, /v1/inputs and /v2/answer and compiled into a filter evaluated once per indexed document, with no length or **-count limit. A remote unauthenticated attacker can submit a short pattern containing many ** tokens to consume CPU for tens of seconds per request, and a small number of requests denies service.\n\n## Affected\n\n- `pathway <= 0.31.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}