CVE-2026-4926
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - ce714d77-add3-4f53-aff5-83d477b104bb
- Published
- 2026-03-26
- Last modified
- 2026-09-17
- Weaknesses
- CWE-1333, CWE-400
Affected products
- Path-to-regexp (Path-to-regexp)
- Path-to-regexp (Pillarjs)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Amq Broker (Redhat)
- Ansible Automation Platform (Redhat)
- Ansible Portal (Redhat)
- Apache Camel Hawtio (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Jboss Data Grid (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Bpms Platform (Redhat)
- Jboss Fuse (Redhat)
- Jbosseapxp (Redhat)
- Logging (Redhat)
- Migration Toolkit Applications (Redhat)
- Migration Toolkit Virtualization (Redhat)
- Multicluster Engine (Redhat)
- Network Observ Optr (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Podman Desktop (Redhat)
- Quay (Redhat)
- Red Hat Single Sign On (Redhat)
- Rhdh (Redhat)
- Satellite (Redhat)
- Service Mesh (Redhat)
- Service Registry (Redhat)
- Trusted Artifact Signer (Redhat)
- Trusted Profile Analyzer (Redhat)
References
- https://cna.openjsf.org/security-advisories.html
- https://access.redhat.com/errata/RHSA-2026:10153
- https://access.redhat.com/errata/RHSA-2026:10172
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:17789
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:24761
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:24866
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:50300
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:9385
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-4926
- https://bugzilla.redhat.com/show_bug.cgi?id=2451867
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4926.json
