CVE-2026-59094High· 7.5▾ MidnightPoC availablePathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each ** token without memoization, giving e…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.8%
Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each ** token without memoization, giving exponential worst-case complexity. The filepath_globpattern value is taken from the body of the unauthenticated HTTP endpoints /v1/retrieve, /v1/inputs and /v2/answer and compiled into a filter evaluated once per indexed document, with no length or **-count limit. A remote unauthenticated attacker can submit a short pattern containing many ** tokens to consume CPU for tens of seconds per request, and a small number of requests denies service.
pathway <= 0.31.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77680Medium· 5.3Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
CVE-2026-121437High· 7.5Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
CVE-2019-25781High· 7.5Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing
CVE-2026-119194High· 7.5pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
CVE-2026-119196High· 7.5pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
CVE-2026-62160High· 8.7Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware