Pathway's document store handles glob patterns supplied by callers without any length or token-count restrictions, an inefficient pattern matching flaw identified as CWE-407. Because the engine uses a simple recursive matcher that branches on each token, a short pattern with many tokens forces the code to explore an exponential number of paths. An unauthenticated user can submit such a pattern through the /v1/retrieve, /v1/inputs, and /v2/answer endpoints, causing the process to consume large amounts of CPU for tens of seconds per request. The resulting slowdown can bring the system to a halt with only a few requests.

The vulnerability exists in all Pathway releases up to and including version 0.31.1. The patch that eliminates the issue is contained in commit d09722e and applies to the Pathway project.

The flaw carries a CVSS score of 8.7, indicating high severity. Although the exposed endpoints are publicly reachable and require no authentication, making exploitation straightforward, an attacker can trigger service degradation or denial of Service with just a handful of crafted requests, and the lack of input limits means the attack can be executed repeatedly. The vulnerability is not listed in CISA's KEV catalog, indicating it has not been reported as exploited in the wild yet. The EPSS score is < 1%, indicating a very low probability of exploitation. The likely attack vector involves sending crafted glob patterns to the unauthenticated HTTP endpoints.