A flaw in dash occurs when the executable is built without the libc fnmatch routine; its internal pattern matcher performs unbounded recursion for patterns containing multiple asterisks. The resulting super‑polynomial backtracking can cause the function to consume excessive CPU resources. A local user who can plant filenames or supply patterns such as *.*.*.*.*.tar.gz to the matcher can trigger this behaviour, leading to a denial of service for that user or for the system if many such invocations occur. The weakness is a pattern matching error (CWE‑1333).

The vulnerability affects systems running Red Hat Enterprise Linux 6 that use the dash shell compiled without libc fnmatch. Specific patch versions are not listed in the advisory; the issue is tied to dash built in the default RHEL 6 environment.

The CVSS score of 5.5 indicates a moderate impact, and the EPSS score of <1% suggests a low likelihood of exploitation at this time. The vulnerability is not recorded in the CISA KEV catalog. The attack vector is local – a user with the ability to create or influence file names processed by dash can trigger the excessive CPU consumption, and no network‑level or privilege‑escalation vectors are described in the advisory.