Skip to content
fr Sign in
7.5 High

CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace…

Description

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected products and versions

Product Affected versions Fixed in
path-to-regexp 8.4 earliest → < 8.4.0 8.4.0
path-to-regexp 8.0 8.0.0 → < 8.4.0 8.4.0
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Cryostat 4 on RHEL 9 4.2 earliest → < 4.2.0-9 4.2.0-9
Migration Toolkit for Virtualization 2.1 1779139872 earliest → < 1779139872 1779139872
Migration Toolkit for Virtualization 2.9 1778927462 earliest → < 1778927462 1778927462
Red Hat Ansible Automation Platform 2.6 1779773804 earliest → < 1779773804 1779773804
Show the 50 other branches
Product Affected versions Fixed in
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Red Hat OpenShift Dev Spaces 3.27 1776795400 earliest → < 1776795400 1776795400
Red Hat OpenShift distributed tracing 3.9.3 1776435608 earliest → < 1776435608 1776435608
Red Hat Trusted Artifact Signer 1.3 1776889929 earliest → < 1776889929 1776889929
Red Hat Trusted Artifact Signer 1.3 1776673130 earliest → < 1776673130 1776673130
Logging Subsystem for Red Hat OpenShift Versions not published
Migration Toolkit for Applications 8 Versions not published
Multicluster Engine for Kubernetes Versions not published
OpenShift Pipelines Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat Single Sign-On 7 Versions not published
Self-service automation portal 2 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Cryostat 4 Versions not published
Network Observability Operator Versions not published
OpenShift Lightspeed Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Trusted Profile Analyzer Versions not published
Red Hat Edge Manager 1.0 1783502438 earliest → < 1783502438 1783502438
Red Hat Edge Manager 1.1 1784127736 earliest → < 1784127736 1784127736
Red Hat OpenShift distributed tracing 3.9.1 1776435608 earliest → < 1776435608 1776435608
Red Hat OpenShift distributed tracing 3.9.2 1776435608 earliest → < 1776435608 1776435608
Red Hat Migration Toolkit for Applications 8.1 1785169013 earliest → < 1785169013 1785169013
Red Hat OpenShift AI 2.25 1787801527 earliest → < 1787801527 1787801527

References

Timeline

  1. Published
  2. Last modified

Other CVEs of path-to-regexp

The 3 CVEs of path-to-regexp →
CVE-2026-4923 Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated… 5.9 Medium CVE-2026-4867 Impact: A bad regular expression is generated any time you have three or more parameters within a single segment,… 7.5 High
Track this CVE